Subscribe to our e-mail newsletters
For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Virus and Vulnerability Roundup
Finance
Security
Computerworld Daily News (First Look and Wrap-Up)
Computerworld Blogs Newsletter
The Weekly Top 10
More E-Mail Newsletters 
Computerworld 2007Subscribe to Computerworld
40 years of the most authoritative source of news and information for IT leaders.

Experts split on Port 445 security risk

'I think the reports are hype,' said one security expert
 

Sign up to receive Security Resource Alerts

June 24, 2005 (IDG News Service) -- More than a week after Microsoft Corp. patched 10 security flaws in its software, security experts are offering differing views on whether an attack that exploits one of these flaws may be brewing.

On Tuesday, research firm Gartner Inc. issued a warning that a vulnerability found in Microsoft's Server Message Block (SMB) file-sharing protocol could be used in a new attack. Because security vendors had noticed a rise in activity related to TCP/IP Port 445, which is associated with SMB, Gartner concluded that a "mass attack" could be in the works.

Ports are special numbers used by Internet protocols to route messages to different applications.

Gartner recommended that users apply the Microsoft patches as soon as possible and ensure that Port 445 is blocked via a firewall. Other security experts, however, were doubtful that a Port 445 attack was imminent.

Port 445 has already been used by so many other attacks, including the Sasser and Nimda worms, that even if a new worm were to be created, it would probably not change things, according to Russ Cooper, senior scientist at Cybertrust Inc. and editor of the NTBugtraq discussion list. "The people that have 445 exposed, and therefore would be vulnerable to attack by last week's exploit, will likely already have been compromised by anything that's been going around for the last three years," he said yesterday.

Cooper was dismissive of reports of a possible Port 445 attack. "People are desperate for something to happen in the security space because it has been so long [since a major attack]," he said. "I think the reports are hype."

A researcher at Symantec Corp., which first noticed the bump in Port 445 activity last week, generally agreed with Cooper's assessment.

"There were several vulnerabilities that came out," said Alfred Huger, senior director of engineering at Symantec Security Response. "This was probably the least severe of those that came up, and it's probably the hardest to exploit."

Users who have a firewall or a router that blocks access to Port 445 are unlikely to be affected by the SMB bug, even if they haven't installed Microsoft's latest patches, he said.

Huger believes that another of last week's vulnerabilities, related to the PNG (Portable Network Graphics) image format, is much more likely to be the source of a widespread attack. Using this exploit, malicious code could be inserted in something as innocuous as a banner ad, he said. "They could break into your computer without you even knowing it," he said.

Gartner analysts could not be reached for comment.


Reprinted with permission from

For more news from IDG visit IDG.net
Story copyright 2006 International Data Group. All rights reserved.


Print this Story Send Us Feedback E-mail this Story Digg! Digg this Story Slashdot this Story
"This company's infrastructure group is running a disaster recovery exercise with a reluctant participant: an IT manager who's notorious as..." Read more...
"It's IT Blogwatch: in which Mozilla's Firefox Web browser continues to gain market share, smashing records as it does so...." Read more...
Read more Security posts or See all Blogs
Microsoft promises four patches next week
Google gives away home-cooked Web application security scanner
Expect iPhone, Fourth of July scams, security firm says
More top stories...
Microsoft trumpets security additions in upcoming IE8
Apple cuts price of high-end SSD MacBook Air by $500
Ultrathin showdown: Apple MacBook Air vs. Lenovo ThinkPad X300 vs. Toshiba Portege R500
All it takes is a couple hours and about $125 to breathe new life into an old laptop. Here's how.
Is Microsoft's Golden Age over? What are Gates' most memorable quotes? Find out in Computerworld's complete coverage of the end of the Bill Gates era at Microsoft.
There are some things your CIO definitely doesn't want to hear. Also don't miss the flipside, Five things you should always tell your boss.
With its latest version, Mozilla's browser continues to raise the bar for what Web browsers should be.
Reviews, analyses, how-tos, visual tours, hot issues and predictions about Microsoft's new OS.
Four years from now, the IT field will be a vastly different place. Will you be ready?
All Zones
Application Performance Zone
Business Continuity Zone
Data Center Management Zone
Enterprise-Class Security Zone
The File Data Management Zone
Grid Computing on Windows Zone
Security Management Zone
ITIL Best Practices Zone
The SAS Zone
Storage Virtualization Zone
Business Intelligence and Analytics Zone

Ads by TechWords

See your link here
Why SaaS is Vital to Email and Web Security
Why SaaS is Vital to Email and Web Security
Download this webcast, free, compilments of Webroot Software
Go to the webcast 
Managing Mobile Data with Endpoint Security for Laptops
Download this white paper now, compliments of Computerworld and Absolute Software.
(Source: Absolute Software) A NetworkWorld survey of IT professionals found that only 1 in 100 employees consistently follow data security policy. This paper outlines endpoint security for laptops that restricts data access beyond encryption to safeguard against insider threats and user error. Read this whitepaper to learn lessons from recent data breaches, limitations of traditional data security, and how to remotely wipe out data and monitor computers that go off the network.
Download this executive briefing download
Top 10 Reasons to Upgrade
Get this white paper now!
(Source: Symantec) Symantec Backup Exec 12 and Backup Exec System Recovery 8 deliver industry leading Windows data protection and system recovery. Download this whitepaper to find out the top reasons to upgrade and how to get continuous data protection and complete system recovery.
Download this white paper go
White Papers
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
Deploying Virtualized NetWare on Linux Whitepaper
Toward More Flexible, Next-Generation Collaboration Solutions
Driving Business Success Through Workgroup Choice and Flexibility
View more whitepapers