TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ----------------------------------------------------------------------------
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Copyright 2001 Internet Security Systems (trademark) THE POWER TO PROTECT INTERNET THREAT & SOLUTIONS UPDATE for Oct 22nd - Oct 24th, 2001 ISS X-Force Special Operations Group - ---------------------------------------- CURRENT THREAT ASSESSMENT & THREAT FORECAST - ---------------------------------------- AlertCon 2 Today, Oct 22nd, 2001 AlertCon 1 For Oct 23rd-24th, 2001 Today's Focus: Defensive Blocking ************* - - We raised the AlertCon to 2 because of credible reports that the New York banking community and Wall Street could expect cyber attacks. We have not seen any manifestation of this threat yet but will hold at AlertCon 2 through mid-day tomorrow as a precaution. - - We anticipate going back to the 'normal chaos' of AlertCon 1 tomorrow. - - For more information on the defacement and other threats from Pakistan-based hackers see the write-up below under Defacement Watch. - - NEW FEATURE: We've added the top ten vulnerabilities our penetration testing has uncovered over the past year. We'll update the list monthly. - ------------------------------------- Today's Focus Solutions - ------------------------------------- - - Defensive blocking of inbound traffic from geographic regions is not a precision tool but can be very effective in reducing your exposure to cyber threats. This can be either a temporary or permanent defensive strategy. - - In addition to blocking IP addresses you also need to take a hard look at what type of traffic is allowed into and out of your network. The days when everything is defaulted to "allow" are gone forever. What ports and protocols do you really need? - - For those enterprises wishing to block potential hacking from Pakistan, there are two ways to approach it. - -- First, you can block individual IP addresses known to your organization that emanate from Pakistan or if you are maintaining a rogue list from previous attacks you can use that. - -- The other approach is much more broad, and therefore much more effective, but broad blocking using the Classless Internet Domain Routing blocks is not precisely keyed to countries or even continental boundaries (like the boundary between Europe and Asia) so you have to consider that you might be affecting legitimate traffic from a large part of the world. In this case, over a weekend, broad blocking may be the way to go, and reassess on Monday (wherever Monday begins for your customer base). - -- Specifically Pakistan Addresses (but not all of them since other domains sell address space regardless of geography): 202.124.192.0 -- 202.124.207.255 202.165.225.0 -- 202.165.255.255 203.128.0.0 -- 203.128.31.255 203.128.252.0 -- 203.128.255.255 203.129.0.0 -- 203.129.3.255 203.130.0.0 -- 203.130.7.255 203.133.0.252.255 -- 203.133.255.255 203.134.252.255 -- 203.134.255.255 203.135.0.0 -- 203.135.63.255 210.56.0.0 -- 210.56.31.255 206.99.198.0-255 206.82.143.0-255 208.141.102.0-255 216.252.164.0-255 63.118.157.48-63 209.58.13.0-255 216.252.186.208-223 - -- Broad Address Blocks (use at your own risk) check with www.ipindex.net <http://www.ipindex.net> for the breakout of these blocks. 202.0.0.0 to 203.255.255.255 - - Since web site attacks are a G-Force Pakistan specialty you also need to make sure your web sites are locked down. No web site should have a direct, unprotected, trusted link to the inside of your network. Web sites should sit outside a firewall/IDS pair in some sort of DMZ. - - Blocking port 80 inbound wherever not needed this weekend (or forever) might also be worth considering. - ------------------------------------- Attack Signature Ranking - global IDS, midnight - midnight, previous day, % of total - ------------------------------------- Unauth Access Attempt 48.10% Suspicious Activity 25.90% Protocol Decode 22.56% Pre-Attack Probe 01.80% Denial Of Service 01.63% Back Door 00.01% - ------------------------------------- Top Ten Attack Destination Ports - global IDS, midnight - midnight, previous day, % of top ten (ports found at <http://www.iana.org/assignments/port-numbers> - ------------------------------------- 80 (http) 96.85% 22 (ssh) 00.94% 25 (smtp) 00.63% 21 (ftp) 00.52% 139 (netbios-ss) 00.49% 123 (ntp) 00.20% 143 (imap) 00.16% 15104 (unassigned) 00.08% 69 (tftp) 00.07% 19 (chargen) 00.07% - --------------------------------------- Top 10 Vulnerabilities, As Found - --------------------------------------- TOP 10 Vulnerabilities found when Penetration Testing over the last year, listed in order of magnitude 1. IIS Decode. <http://xforce.iss.net/alerts/advise77.php#list> 2. IIS Unicode translation errors. <http://xforce.iss.net/alerts/advise68.php#list> 3. IIS unauthorized ODBC data access with RDS. <http://xforce.iss.net/static/1212.php> 4. SQL injection. discussed in <http://xforce.iss.net/static/5972.php> , papers at: <http://www.securityfocus.com/templates/archive.pike?list=98&mid=200002> <http://www.blackhat.com/presentations/win-usa-01/Litchfield/BHWin01Litc hfield.doc> <http://www.securityfocus.com/templates/archive.pike?list=1&mid=13882> 5. mssql sa blank password <http://xforce.iss.net/static/1459.php> 6. netbios blank/guessable passwords. general issues - CAN-1999-0504 and CAN-1999-0505 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0505> 7. open x-windows. <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0526> This is a direct function of poor security architecture. 8. Poor server configuration. e.g. web server directories without index files or access control. 9. Weak Passwords and poorly protected password files. Easy access to SAM databases; server daemons running with root or system privileges. 10. Lack of 'defense in depth'. Over-relieance on firewalls. Lack of host-based security. Excessive or incorrectly implemented firewall rules. Lack of change control. - --------------------------------------- VIRUS, VULNERABILITY, NEWS UPDATES - --------------------------------------- - - Visit <http://www.iss.net> under 'Global Internet Threat Intelligence Service' - - According to Sophos <http://www.sophos.com/virusinfo/topten/> the top ten viruses in September 2001 were: 1. Nimda-A 71.2% 2. Sircam-A 11.4% 3. Magistr-A 03.7% 4. Magistr-B 03.0% 5. Hybris-B 01.5% 6. Apology-B 00.7% 7. VBS/Kakworm 00.7% 8. Floss 00.7% 9. Bymer-A 00.5% 10. Badtrans-A 00.4% - --------------------------------------- Defacement Watch - --------------------------------------- - - Alldas.de stats show that since April, 2000, the most defaced OS is Windows, with a total of 15,403 defacements reported, for 64% of the total. Although growing in popularity as a target, Linux is a distant second with 4167 defacements for 17% of the total. - - Alldas reports 50 sites defaced last Friday, 103 on Saturday, and 124 on Sunday. These weekend numbers are a return to high-normal activity common May-July, but not seen since then. Details can be seen at <http://www.alldas.de> under 'current month'. - - A review of the defaced sites showed no obvious campaign against either the U.s. Military or financial institutions. Since Friday there were only two reported defacements of U.S. government or military sites on the Alldas.de mirror list. The first was www.dtepi.mil <http://www.dtepi.mil> defaced by G-Force Pakistan with a long political message. <http://defaced.alldas.de/mirror/2001/10/20/www.dtepi.mil/> The other was the Air Force ROTC Detachment at Virginia Tech, defaced by a group called TeckLife which posted no political message. Of the very few financial sites that were defaced over the weekend none were U.S. and none had any political content to the defacement. - - A Brazilian group calling itself Osama bin Laden has emerged with one defacement. There was no political message on its defacement of a commercial Brazilian site. - - COMMENT: Alldas.de only sees a fraction of the web sites defaced but is a well known defacement reporting site and is commonly notified of any defacements with political messages when the hackers want public attention. - --------------------------------------- NOTES, COPYRIGHT NOTICE, and DISCLAIMER - --------------------------------------- NOTE 1: Our web site has this information in more attractive format and graphics available to the public at no cost at www.iss.net <http://www.iss.net> under 'Global Internet Threat Intelligence Service' <https://gtoc.iss.net/secure/whatshot.php> Screen captures (Control/PrtSc) of the site's pages dropped into PowerPoint can be an effective way to communicate various aspects of the Internet threat, e.g. the graph depicting 'AlertCon Trends' <https://gtoc.iss.net/secure/graph.html> NOTE 2: We provide this information on Internet threat metrics, viruses, vulnerabilities, patches, and breaking news, in the spirit of PDD 63, to help security professionals wage the war against Internet threats more effectively. Information in this update derived primarily from global, real time, 24 x 7 IDS feeds, ISS X-Force R&D Team research, and professional liaison. Other sources as noted. AlertCon 1 reflects the global, malicious, determined, 24 x 7 attacks experienced by all networks. AlertCon 2 means increased vigilance/action recommended due to a specific threat or concern. AlertCon 3 means increased attacks against specific targets or vulnerabilities on a scale that is unusually high, action required. AlertCon 4 reflects an Internet emergency for a target or group of targets whose business continuity may depend on some sort of immediate, decisive action. All summaries cover 24 hours the previous workday, GMT. Monday summaries may cover some weekend activity. Copyright 2001 Internet Security Systems, Inc. Permission is granted for the redistribution of the Internet Threat Update electronically. It is not to be sold or edited in any way without express consent of ISS. Refer comments or questions to [EMAIL PROTECTED] mailto: [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> Disclaimer: This information is subject to change without notice. Use of this information constitutes acceptance for use in an 'as is' condition. There are no warranties with regard to this information. In no event shall the author be liable for any damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk. No other use authorized. FOIA Exemption 4. Dennis Dennis Treece Director, Global MSS Special Operations Group Internet Security Systems (ISS) 6303 Barfield Road Atlanta, Georgia 30328 404-236-4065 Fax 404-236-3255 -----BEGIN PGP SIGNATURE----- Version: PGP 6.5 iQA/AwUBO9Q6D+OOe/7N9KJeEQLmbQCfU8A7kGKrBPoqckbqi4T7hVn/ZNsAoNu/ 2HJQ/whVajGOMauMMOZThi46 =vCfW -----END PGP SIGNATURE-----
