For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Subscribe to
Computerworld 40 years of the most authoritative source of news and information for IT leaders.
Worm Lays Waste To IT's Defenses
or
Other Security Stories
|
|
|
|
May 31, 2004 (Computerworld) -- I was planning to spend my week evaluating disk encryption products before the Sasser worm breached our defenses. What's more frustrating than the worm, however, is the fact that proposed projects that could have prevented it have been bogged down for a number of reasons.
My team and I are almost done selecting a patch management product and have all but decided on PatchLink Update from PatchLink Corp. in Scottsdale, Ariz. We run a wide range of servers and operating systems, and PatchLink seemed to work with the majority of them during our evaluation.
Meanwhile, we continue to deal with frustrating patching problems. The W32/Sasser attack is the latest example.
Sasser takes advantage of a previously known vulnerability within Microsoft's Local Security Authority Subsystem Service, which helps manage security and authentication for Windows networking. Had we applied the appropriate patches when they were released, my company might have avoided the worm.
As it was, we first realized that something had gone wrong when the IT help desk received a spate of calls about arbitrary system shutdowns and references to a dialog box indicating an "LSA Shell" problem. At about the same time, network bandwidth usage spiked.
We turned to our in-house Snort intrusion-detection system expert, who quickly associated the traffic with Sasser. This worm attacks by looking for vulnerable machines through TCP Port 445, which is used for Windows networking. Once Sasser finds a vulnerable host, it spreads itself by installing a file transfer protocol server on Port 5554 and leaves Port 9996 open for commands to execute. It then modifies several registry entries and services, causing the system shutdowns. Finally, it spreads by scanning other systems for vulnerable hosts and directing those to the FTP server port to download the malicious code.
The impact of Sasser on my company was substantial. Help desk calls started coming in from all of our hub sites as well as from overseas and remote users with corporate Digital Subscriber Line connections. Although we knew we had to find every infected system, we lacked the time and resources to locate them all. So, to buy time, we asked the network engineering group to reconfigure the access control lists on our network devices to block Ports 5554 and 9996. We use Mountain View, Calif.-based Solsoft Inc. to centrally manage many of our ACLs. Unfortunately, we also have many network devices that it doesn't manage, and we spent several hours visiting every one of them.
After the ACLs were updated, network degradation decreased, as did the speed at which Sasser was spreading. Now we had to identify the machines that had Port 5554 or 9996 open.
Back to Port
My company has several Linux servers that we use to conduct automated scanning.
|
Print this Story |
|
Send Us Feedback |
|
E-mail this Story |
|
Digg this Story |
|
Slashdot this Story |
|
|
|
|
|
|
 |
|
All Zones Application Performance Zone Business Continuity Zone Data Center Management Zone Enterprise-Class Security Zone The File Data Management Zone Grid Computing on Windows Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone Business Intelligence and Analytics Zone |
 See your link here
|
 |
||||||||
| ||||||||
| ||||||||
| ||||||||
|
Why SaaS is Vital to Email and Web Security
Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs.
Get this white paper now!
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
- Microsoft promises four patches next week
- Google gives away home-cooked Web application security scanner
- Expect iPhone, Fourth of July scams, security firm says
- More top stories
Security Management ZoneSecurity management is the process of developing a comprehensive data protection plan. It takes into account all potential threats, the existing network environment, the future needs of the organization, and lays out a multi-tiered blueprint to integrate the security technology needed to combat these threats. CDW can help keep your network and data secure. Visit the CDW Security Management Zone now See All Zones
|
 Fired up about IT? Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day.New baits 
|
"Security Directions" virtual trade show2008's Code-Red Security Issues for Protecting the EnterpriseWebcasts, white papers, demos, and more. Presented in a unique 3-d environment. Enter our show right now! Click here to enter
|
 In SecuritySecurity's important, and risk must be addressed, right? Sure, but watch for four signs your policies go a bit overboard. Click here to read the latest column by Jon Espenschied |
CIO
Computerworld
CSO
DEMO
GamePro
Games.net
IDG Connect
IDG World Expo
Infoworld
The Industry Standard
ITworld
JavaWorld
LinuxWorld
MacUser
Macworld
Network World
PC World
Playlist
Copyright © 2008 Computerworld Inc. All
rights reserved. Reproduction in whole or in part in any form or medium
without express written permission of Computerworld Inc. is prohibited.
Computerworld and Computerworld.com and the respective logos are
trademarks of International Data Group Inc.
|
