TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ----------------------------------------------------------------------------
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 INTERNET THREAT UPDATE for 01-18-2002 ISS X-Force Special Operations Group www.iss.net - Click on 'Current Internet Threat' for more information. ****************************************************** ALERTCON 1 Projected: AlertCon 1 ****************************************************** ALERTCON 1 - AlertCon 1 reflects the malicious, determined, global, 24 x 7 attacks experienced by all networks. NIPC: The National Infrastructure Protection Center has issued a well-crafted advisory regarding infrastructure related information being accessed via the Internet from sites around the world. NIPC provides some points to consider when evaluating website content from a security perspective. To review the advisory click here. MICROSOFT: HFNetChk version 3.3 is now available. HFNetChk is a command line tool used to assess a computer or group of computers for their current security hotfix status. HFNetChk can be launched from an NT4 or greater system, and can report on hotfix status for Windows NT 4.0, Windows 2000, Windows XP, IIS 4, IIS 5, IIS 5.1, Internet Explorer 5.01 and later, SQL Server 7.0 and SQL Server 2000. You may obtain the program via the download link on Knowledge Base Article Q303215, or directly via the Microsoft Download Center page. VIRUSES/WORMS: W32.Klez was discovered yesterday. It exploits a vulnerability in Microsoft Outlook and Outlook Express in an attempt to execute itself when you open or even preview the message in which it is contained. W32/ElKern-B is an executable file virus that works under Windows 98, Windows Me, Windows 2000 and Windows XP. It is capable of infecting file cavities, meaning that it may not change the sizes of files it infects. - ------------------------------------------------------ RECOMMENDATIONS - ------------------------------------------------------ For the NIPC Alert: http://www.nipc.gov/warnings/advisories/2002/02-001.htm For the Internet Security Systems Security Alert Summary AS02-02 please see: http://xforce.iss.net/alerts/AS02-02.php For the Microsoft download, please refer to: http://www.microsoft.com/downloads/release.asp?releaseid=31154 For information of the W32.Klez worm go to: http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.e@mm. html For information regarding the W32/ElKern-B, refer to: http://www.sophos.com/virusinfo/analyses/w32elkernb.html For other current worms and viruses moving across the Internet see: https://gtoc.iss.net/secure/viruses.php http://www.antivirus.com/vinfo/ - ------------------------------------------------------ FACTOID: The U.S. Government is taking proactive steps in the fight against Cybercrime. The Department of defense has allocated $86 million for cybercrime training and the FBI has created a new unit whose main investigative focus is on cybercrime. COMMENTARY: The third category of hacker is "The Knowing Thief." And this person, at his worst, is a person of sufficiently poor skills that he leaves the footprints of a Trophy Hunter. At his best, this is a highly skilled and clever professional who is well compensated for his efforts in either money or personal satisfaction or both. Of course, his best is your worst nightmare. Like the Best Friend, his success depends on his stealth skills. He will have and use excellent social engineering skills. He has extensive technical skills and usually specializes in certain technology areas, like a particular operating system or decompiling and analysis of programming code for security-related defects. This individual is looking to do real harm to your networks, if that is what satisfies him. Unhappy employees and ex-employees are the number one source for this kind of damage. Actual theft of services, data, etc. may be the aim of the above groups, as well as outsiders. Examples of The Knowing Thief abound in documented cases of ex-employee logic bombs and takedown hacks, employees manipulating monetary data, outsiders stealing customer data, and theft of unpatented technology, sometimes across international borders. If you don't have an excellent security environment, including repeated employee training, you will be a victim to this hacker category. It's just a matter of time. - ------------------------------------------------------ ATTACK SIGNATURE RANKING - global IDS, midnight - midnight, previous Day, % of total - ------------------------------------------------------ Unauthorized Access Attempt 40.64% Protocol Decode 32.37% Pre-Attack Probe 14.31% Denial Of Service 10.70% Suspicious Activity 01.96% Back Door 00.02% - ------------------------------------------------------ TOP TEN ATTACK DESTINATION PORTS - global IDS, midnight - midnight, previous day, % of top ten (ports found at) http://www.networkice.com/Advice/Exploits/Ports/default.htm - ------------------------------------------------------ 80 (http) 81.57% 53 (DNS) 07.63% 21 (ftp) 04.63% 25 (smtp) 02.56% 443 (ssl) 01.13% 515 (lp,lpr,printer) 00.83% 22 (ssh) 00.73% 69 (tftp) 00.41% 1214 (unassigned) 00.30% 68 (bootpd/dhcp) 00.19% - ------------------------------------------------------ BACKGROUND, COPYRIGHT NOTICE, and DISCLAIMER - ------------------------------------------------------ Background. We provide this information in the spirit of PDD 63 to help security professionals wage the war against Internet threats more effectively. Information in this update derived primarily from global, real time, 24 x 7 IDS feeds, ISS X-Force R&D Team research, and professional liaison. Other sources as noted. AlertCon 1 reflects the global, malicious, determined, 24 x 7 attacks experienced by all networks. AlertCon 2 means increased vigilance/action recommended due to a specific threat or concern. AlertCon 3 means increased attacks against specific targets or vulnerabilities on a scale that is unusually high, action required. AlertCon 4 reflects an Internet emergency for a target or group of targets whose business continuity may depend on some sort of immediate, decisive action. All summaries cover 24 hours the previous workday, GMT. Monday summaries may cover some weekend activity. Copyright 2001 Internet Security Systems, Inc. Permission is granted for the redistribution of the Internet Threat Update electronically. It is not to be sold or edited in any way without express consent of ISS. Refer comments or questions to: [EMAIL PROTECTED] or [EMAIL PROTECTED] Disclaimer: This information is subject to change without notice. Use of this information constitutes acceptance for use in an 'as is' condition. There are no warranties with regard to this information. In no event shall the author be liable for any damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk. No other use authorized. FOIA Exemption 4. Patrick Gray Manager, X-Force Internet Threat Intelligence Center Internet Security Systems 6303 Barfield Road Atlanta, GA 30328 -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.4 iQA/AwUBPEg9HJG41ROSQPncEQIJxwCg2QI88zyUHfXtdNxT3rAa4pibwHIAoNPW nLxsvRvbQ9eFgj0u3eVxquVk =J+JK -----END PGP SIGNATURE-----
