Worm Lays Waste To IT's Defenses
Politics, project delays and an ineffective response allow for a Sasser disaster.
Computerworld - I was planning to spend my week evaluating disk encryption products before the Sasser worm breached our defenses. What's more frustrating than the worm, however, is the fact that proposed projects that could have prevented it have been bogged down for a number of reasons.
My team and I are almost done selecting a patch management product and have all but decided on PatchLink Update from PatchLink Corp. in Scottsdale, Ariz. We run a wide range of servers and operating systems, and PatchLink seemed to work with the majority of them during our evaluation.
Meanwhile, we continue to deal with frustrating patching problems. The W32/Sasser attack is the latest example.
Sasser takes advantage of a previously known vulnerability within Microsoft's Local Security Authority Subsystem Service, which helps manage security and authentication for Windows networking. Had we applied the appropriate patches when they were released, my company might have avoided the worm.
As it was, we first realized that something had gone wrong when the IT help desk received a spate of calls about arbitrary system shutdowns and references to a dialog box indicating an "LSA Shell" problem. At about the same time, network bandwidth usage spiked.
We turned to our in-house Snort intrusion-detection system expert, who quickly associated the traffic with Sasser. This worm attacks by looking for vulnerable machines through TCP Port 445, which is used for Windows networking. Once Sasser finds a vulnerable host, it spreads itself by installing a file transfer protocol server on Port 5554 and leaves Port 9996 open for commands to execute. It then modifies several registry entries and services, causing the system shutdowns. Finally, it spreads by scanning other systems for vulnerable hosts and directing those to the FTP server port to download the malicious code.
The impact of Sasser on my company was substantial. Help desk calls started coming in from all of our hub sites as well as from overseas and remote users with corporate Digital Subscriber Line connections. Although we knew we had to find every infected system, we lacked the time and resources to locate them all. So, to buy time, we asked the network engineering group to reconfigure the access control lists on our network devices to block Ports 5554 and 9996. We use Mountain View, Calif.-based Solsoft Inc. to centrally manage many of our ACLs. Unfortunately, we also have many network devices that it doesn't manage, and we spent several hours visiting every one of them.
After the ACLs were updated, network degradation decreased, as did the


- Excel 2010 Cheat Sheet
- Register for this Computerworld Insider Cheat Sheet and gain access to hundreds of premium content articles, guides, product reviews and more.
- Driving Secure Enterprise File Sharing and Syncing in the Enterprise
- GroupLogic's new activEcho is the industry's only secure Enterprise File Sharing and Synching solution that balances the need for simplicity for the end...
- The Enterprise File Sharing Option
- Enterprises and IT departments need to address several critical security issues when considering file sharing and syncing products. Many of today's solutions do...
- Security Strategies to Virtualizing Internet-Facing Applications
- The IT organization at Intel has set a goal to transition their enterprise to a private cloud for their Office and Enterprise applications....
- Cloud Security Planning Guide
- Cloud security considerations span protecting hardware and platform technologies in the data center to enabling regulatory compliance and defending cloud access through different...
- Cloud Security Vendor Round Table
- This vendor round table guide will help you to evaluate different cloud technology vendors and service providers based on a series of questions... All Security White Papers
- Live Webcast
Data Privacy and Protection in Production Environments: New Research from Ponemon Institute - Date: Wednesday, June 13, 2012, 1:00 PM EDT / 10:00 AM PDT
In a recent study conducted by Ponemon Institute, fifty-five percent of respondents... - Data Privacy and Protection in Production Environments: New Research from Ponemon Institute
- Date: Wednesday, June 13, 2012, 1:00 PM EDT / 10:00 AM PDT
In a recent study conducted by Ponemon Institute, fifty-five percent of respondents... - Security Certifications 101 - BlackBerry and all those acronyms what do they mean and why they matter?
- FIPS, Common Criteria, CAPS, AISEP, NFC, NIST, Fraunhofer SIT, CESG, DSD - these are just some of the government and industry certifications which...
- BlackBerry PlayBook OS 2.0 Security Overview
- The presentation provides an overview of BlackBerry PlayBook OS 2.0 security capabilities and features, including: BlackBerry® Balance™ technology, BlackBerry® Bridge, data-at-rest protection, and...
- BlackBerry NFC Security Overview
- The presentation on NFC security will provide an overview of the security protections built into the BlackBerry platform to protect users, application developers...
- Playing Defense: Staying on Top of Your Disaster Recovery Game
- When it comes to disaster recovery, rapidly growing data volumes, distributed computing models, and new technologies all combine to present an ever-changing playing... All Security Webcasts