TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ----------------------------------------------------------------------------
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 INTERNET THREAT UPDATE for 01-16-2002 ISS X-Force Special Operations Group www.iss.net - Click on 'Current Internet Threat' for more information. ****************************************************** ALERTCON 1 Projected: AlertCon 1 ****************************************************** ALERTCON 1 - AlertCon 1 reflects the malicious, determined, global, 24 x 7 attacks experienced by all networks. MICROSOFT: Has said it has fixed a flawed domain name server that prevented users of Windows XP from downloading software updates and security patches over the past few days. The Windows Update contains a collection of fixes and software updates to Windows that users can download for free. LINUX: The Mandrake Variety - the SuSE Security Team discovered a vulnerability in sudo that can be exploited to obtain root privilege because sudo is installed setuid root. An attacker could trick sudo to log failed sudo calls executing the sendmail (or equivalent mailer) program with root privileges and an environment that is not completely clean. This problem has been fixed upstream by the author in sudo 1.6.4 and it is highly recommended that all users upgrade regardless of what mailer you are using. SOLARIS: Just a gentle reminder that the Sun Microsystems Solaris operating system has a vulnerability wherein a buffer overflow has the ability to allow a villain full access to its capabilities. The vulnerabilities in the Common Desktop Environment have been actively exploited according to CERT/CC. VIRUSES/WORMS: The X97M.ROH.A virus is written in macro language, and it infects Microsoft Excel worksheets. The virus spreads by first checking for the existence of the file \XLStart\Ft.xls. If the file does not exist, the virus creates the file -R�H.xls in the XLStart folder. This file will be executed every time that Microsoft Excel starts. The VBS_FUNNY.D VBScript worm propagates via email by sending a message to addresses listed in an infected user's Microsoft Outlook address book. The email arrives with the attachment "VERY FUNNY POLITICAL JOKE.TXT.VBS." FACTOID: According to CERT/CC the latest set of figures documenting security incidents show 52,658 incidents were reported in 2001 compared to 21,756 in 2000. CERT/CC, hosted by Carnegie Mellon University, was set up in 1988 at the behest of the U.S. Government to coordinate communications during security emergencies. There were 6 incidents reported that year. COMMENTARY: We have seen no letup in nefarious activity on the Internet by hackers, or by whatever nom de guerre you use for these individuals. Unfortunately, we are not able to 'profile' a typical hacker, as there is no template into which they all fall. Basically, they are lumped into three categories: The Trophy Hunters - this version, sometimes known as 'Script Kiddies', are less skilled and rely on using someone else's code. They traverse the Internet seeking sites and chat rooms where they can download tools to inflict their brand of mayhem, usually in the form of a defaced website. They usually tout their alias or 'nic' or the name of a hacking group to which they belong. Sometimes they leave a message for the system administrator belittling the website or system security. Generally, no damage is done to the contents of the site. These defacements are trophies, the Script Kiddies' way of flexing their 'hacking ability' muscles. Unfortunately, their pesky, gnat-like, bothersome behavior can cost businesses revenue, system downtime and a loss of customer faith. These can make even a Trophy Hunter an expensive pest. Constant vigilance at your perimeter is warranted. Tomorrow, we will look at the more skilled hacker, 'Your Best Friend'. - ------------------------------------------------------ RECOMMENDATIONS - ---------------------------------------------------------------------- - ----------- For the Microsoft Update, go to: http://windowsupdate.microsoft.com X-Force Advisory regarding the UPnP and IE 5.5 and 6.0 issues see: http://xforce.iss.net/alerts/advise107.php http://xforce.iss.net/alerts/advise106.php For the Mandrake Advisory and solution, please see: http://linuxtoday.com/news_story.php3?ltsn=2002-01-16-012-20-SC-MD Information regarding the exploitation of the vulnerability in the CDE, please see: http://xforce.iss.net/alerts/advise101.php http://www.cert.org/advisories/CA-2002-01.html For information regarding the X97M.ROH.A virus please see: http://securityresponse.symantec.com/avcenter/venc/data/x97m.roh.a.htm l For information on the VBS_FUNNY.D virus, please see: http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=VBS_FUN NY.D For other current worms and viruses moving across the Internet see: https://gtoc.iss.net/secure/viruses.php http://www.antivirus.com/vinfo/ - ------------------------------------------------------ ATTACK SIGNATURE RANKING - global IDS, midnight - midnight, previous Day, % of total - ------------------------------------------------------ Unauthorized Access Attempt 46.91% Denial Of Service 26.89% Protocol Decode 16.53% Pre-Attack Probe 05.31% Suspicious Activity 04.32% Back Door 00.04% - ------------------------------------------------------ TOP TEN ATTACK DESTINATION PORTS - global IDS, midnight - midnight, previous day, % of top ten (ports found at) http://www.networkice.com/Advice/Exploits/Ports/default.htm - ------------------------------------------------------ 80 (http) 81.61% 25 (smtp) 03.65% 515 (lp,lpr,printer) 02.99% 21 (ftp) 02.93% 1214 (unassigned) 02.75% 443 (ssl) 02.21% 22 (ssh) 01.27% 53 (DNS) 01.14% 69 (tftp) 00.76% 139 (NetBIOS) 00.70% - ------------------------------------------------------ BACKGROUND, COPYRIGHT NOTICE, and DISCLAIMER - ------------------------------------------------------ Background. We provide this information in the spirit of PDD 63 to help security professionals wage the war against Internet threats more effectively. Information in this update derived primarily from global, real time, 24 x 7 IDS feeds, ISS X-Force R&D Team research, and professional liaison. Other sources as noted. AlertCon 1 reflects the global, malicious, determined, 24 x 7 attacks experienced by all networks. AlertCon 2 means increased vigilance/action recommended due to a specific threat or concern. AlertCon 3 means increased attacks against specific targets or vulnerabilities on a scale that is unusually high, action required. AlertCon 4 reflects an Internet emergency for a target or group of targets whose business continuity may depend on some sort of immediate, decisive action. All summaries cover 24 hours the previous workday, GMT. Monday summaries may cover some weekend activity. Copyright 2001 Internet Security Systems, Inc. Permission is granted for the redistribution of the Internet Threat Update electronically. It is not to be sold or edited in any way without express consent of ISS. Refer comments or questions to: [EMAIL PROTECTED] or [EMAIL PROTECTED] Disclaimer: This information is subject to change without notice. Use of this information constitutes acceptance for use in an 'as is' condition. There are no warranties with regard to this information. In no event shall the author be liable for any damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk. No other use authorized. FOIA Exemption 4. Patrick Gray Manager, X-Force Internet Threat Intelligence Center Internet Security Systems 6303 Barfield Road Atlanta, GA 30328 -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.4 iQA/AwUBPEWo8ZG41ROSQPncEQLThACeIjRMfXOY3YyZQB8b6TTqVrdjIooAoMG9 C/4xjoj17EHzY5NiTw+7gDQe =JvEA -----END PGP SIGNATURE-----
