TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ----------------------------------------------------------------------------
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 INTERNET THREAT UPDATE for 01-17-2002 ISS X-Force Special Operations Group www.iss.net - Click on 'Current Internet Threat' for more information. ****************************************************** ALERTCON 1 Projected: AlertCon 1 ****************************************************** ALERTCON 1 - AlertCon 1 reflects the malicious, determined, global, 24 x 7 attacks experienced by all networks. FBI WARNING: The FBI warned law enforcement and high-tech companies to be on guard for possible terrorist activity that could use or affect the Internet. The alert warned of possible attacks on or through utility, municipal and state information systems. It was not specific in its time frame or geographic area. ICQ: A security flaw has been found in the ICQ Voice Video and Games feature, similar to those found in AOL's Instant Messenger (AIM). The vulnerability targets ICQ versions earlier than 2001b. It is flawed in the way that it handles a certain data packet, causing a buffer overflow and potentially allowing an attacker to run arbitrary code on a user's computer. SOLARIS: We will again mention this vulnerability. The security flaw in the Common Desktop Environment (CDE) graphical user interface for *nix systems has a remotely exploitable buffer overflow flaw in the CDE Subprocess Control Service. This is known as 'dtspcd', which accepts requests from clients to execute commands and launch applications remotely. As a result, a malicious client can manipulate data sent to dtspcd and cause a buffer overflow, potentially executing code with root privileges, according to CERT/CC. DEBIAN: A new alert has been released - a bug has been found in the current implementation of 'at' which leads into a heap corruption vulnerability, which in turn could potentially lead to an exploit of the daemon user. VIRUSES/WORMS: The W32.Spester@mm is a worm that spreads as a .zip file. Within the .zip file is the worm executable file. The executable creates a Visual Basic Script file that attempts to send the compressed .zip file to all of the contacts in your e-mail address book. The social engineering feature of this worm is that it prompts you to 'check your mouse skills'. The Worm_TOGET.A has the subject line, 'Dating, Talking and Kissing...' with a body that says, 'Here's some visual pics of you...'. Not as catchy as Anna Kournikova but it will work among the uninformed. FACTOID: Broadband accounts are expected to climb from 11.5 million in 2001 to 43.4 million in 2005, according to IDC's Broadband Markets and Technologies Group. A robust playground in the offing for the hacking community. With this rapid growth of high-speed modems we can expect the bad guys to continue to target the newly connected computers, ICQ, AIM and then perhaps move towards wireless as well. COMMENTARY: The second category of hacker is 'Your Best Friend.' This is the hacker who penetrates your network because you have something the hacker can use - or misuse - for his purposes. Perhaps your network will be a zombie providing bandwidth for a DDoS, a hard disk space provider for a warez site, an unknowing sponsor for an IRC channel, a relay point for a spam or mail bomb operation, or provide long distance service via your networked PBX system. Your Best Friend will want your systems fully operational at all times, because "su red, mi red." He may even use his trojans and backdoors to improve the security of your system - with, of course, one exception: he AND his friends. After all, he thinks, "We can't have 'our' network belonging to anyone else." Even though he is stealing your bandwidth, your storage space, your phone service, he doesn't see himself as a thief, but a Robin Hood. After all, your company has so much and he wants so little. He isn't a "script kiddie", his skill level is high, he leaves very few footprints, and his success depends on you not knowing he co-owns your network. But he is not the best of the worst. He has not made that last mental step to the third hacker type: The Knowing Thief. - ------------------------------------------------------ RECOMMENDATIONS - ---------------------------------------------------------------------- - ----------- For the Internet Security Systems Security Alert Summary AS02-02 please see: http://xforce.iss.net/alerts/AS02-02.php For the FBI Warning, please see the article: http://www.siliconvalley.com/docs/news/svfront/004689.htm For the ICQ patch, go to: http://web.icq.com/help/quickhelp/1,,117,00.html Regarding the Solaris vulnerability visit: http://www.cert.org/advisories/CA-2002-01.html http://xforce.iss.net/alerts/advise101.php With respect to the Debian advisory, we recommend that you upgrade your 'at' packages and refer to: http://www.debian.org/security/2002/dsa-102 For information of the Spester and TOGET worms, do to: http://securityresponse.symantec.com/avcenter/venc/data/w32.spester@mm .html and http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=WORM_TO GET.A For other current worms and viruses moving across the Internet see: https://gtoc.iss.net/secure/viruses.php http://www.antivirus.com/vinfo/ - ------------------------------------------------------ ATTACK SIGNATURE RANKING - global IDS, midnight - midnight, previous Day, % of total - ------------------------------------------------------ Unauthorized Access Attempt 37.82% Pre-Attack Probe 27.05% Protocol Decode 18.12% Denial Of Service 13.62% Suspicious Activity 03.35% Back Door 00.04% - ------------------------------------------------------ TOP TEN ATTACK DESTINATION PORTS - global IDS, midnight - midnight, previous day, % of top ten (ports found at) http://www.networkice.com/Advice/Exploits/Ports/default.htm - ------------------------------------------------------ 80 (http) 72.25% 53 (DNS) 15.82% 25 (smtp) 04.67% 21 (ftp) 02.09% 443 (ssl) 01.39% 22 (ssh) 01.06% 45340 (unassigned) 00.91% 515 (lp.lpr,printer) 00.75% 69 (tftp) 00.66% 44044 (unassigned) 00.42% - ------------------------------------------------------ BACKGROUND, COPYRIGHT NOTICE, and DISCLAIMER - ------------------------------------------------------ Background. We provide this information in the spirit of PDD 63 to help security professionals wage the war against Internet threats more effectively. Information in this update derived primarily from global, real time, 24 x 7 IDS feeds, ISS X-Force R&D Team research, and professional liaison. Other sources as noted. AlertCon 1 reflects the global, malicious, determined, 24 x 7 attacks experienced by all networks. AlertCon 2 means increased vigilance/action recommended due to a specific threat or concern. AlertCon 3 means increased attacks against specific targets or vulnerabilities on a scale that is unusually high, action required. AlertCon 4 reflects an Internet emergency for a target or group of targets whose business continuity may depend on some sort of immediate, decisive action. All summaries cover 24 hours the previous workday, GMT. Monday summaries may cover some weekend activity. Copyright 2001 Internet Security Systems, Inc. Permission is granted for the redistribution of the Internet Threat Update electronically. It is not to be sold or edited in any way without express consent of ISS. Refer comments or questions to: [EMAIL PROTECTED] or [EMAIL PROTECTED] Disclaimer: This information is subject to change without notice. Use of this information constitutes acceptance for use in an 'as is' condition. There are no warranties with regard to this information. In no event shall the author be liable for any damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk. No other use authorized. FOIA Exemption 4. Patrick Gray Manager, X-Force Internet Threat Intelligence Center Internet Security Systems 6303 Barfield Road Atlanta, GA 30328 -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.4 iQA/AwUBPEb6zpG41ROSQPncEQKPaQCfYzr0AuBOTKtMJD0XGfmOO9gMBk8AoLpV vMJihIiL8p2I3r1htWRfcdDM =oy7J -----END PGP SIGNATURE-----
