TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ----------------------------------------------------------------------------
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 INTERNET RISK UPDATE for 06-14-2002 ISS X-Force Internet Threat Intelligence Center www.iss.net - Click on the AlertCon logo for more information. ******************************************** ALERTCON 2 Projected: AlertCon 2 ******************************************** ALERTCON 2 - We have raised the AlertCon to 2 to advise of the need to apply Microsoft patches as reflected below. VULNERABILITIES: Microsoft has published three advisories for a heap overrun in HTR, an unchecked buffer in the Remote Access Service (RAS), and two issues in SQLXML. The combination of these issues presents an excellent opportunity for mischief ranging from crashing a system to an escalation of privileges by running an attacker's choice of code. The risk for an unpatched system is deemed critical. Information gathered from reliable sources indicates that there is a strong possibility for a DDoS (distributed denial-of-service) attack for June 14, 2002. This attack is a virtual sit-in as part of a series of attacks against companies that are part of a group keeping Huntingdon Life Sciences in business or conduct animal research themselves. Physical vandalism has been reported with this series of events during this week against some of the targeted companies. You can learn more information by visiting http://www.huntingdonsucks.com/ecd.html. This site is blocking security companies from accessing their site. They have planned their sit-in for 1300 hours GMT or 0900 EDT. Huntingdon Life Sciences is at http://www.huntingdon.com/ Tools for the sit-in are provided by the electrohippie collective at http://www.fraw.org.uk/ehippies/tools.shtml VIRUSES/WORMS: W32/Perrun-A is a Win 32 executable normally with an executable named proof. When proof is run it drops another executable, extrk. It also modifies the registry such that when a user double clicks on a .JPG file it runs the extrk. instead of the originally associated picture viewer. This is the first known JPEG infector. ******************************************** RECOMMENDATIONS ******************************************** ISS X-Force strongly recommends that patches be applied immediately and rates these vulnerabilities, cumulatively, as critical. Please refer to: <http://microsoft.com/technet/treeview/default.asp?url=/technet/securi ty/bulletin/MS02-028.asp> <http://microsoft.com/technet/treeview/default.asp?url=/technet/securi ty/bulletin/MS02-029.asp> <http://microsoft.com/technet/treeview/default.asp?url=/technet/securi ty/bulletin/MS02-030.asp> For a list of current vulnerabilities, please see: https://gtoc.iss.net/vulnerabilities.php For information on the current Virus/Worm of the day, please refer to: http://www.sophos.com/virusinfo/analyses/w32perruna.html Information regarding other viruses and worms please see: https://gtoc.iss.net/viruses.php ******************************************** FACTOID: Every student's grades at a Broward County, Florida High School are being re-examined after a junior admitted hacking into the school's computer and changing classmates' grades for $5. Two students, described as "computer whizzes," were suspended for 10 days this month for violating the district's student code of conduct regulating technology that forbids "vandalizing data [and] infiltrating systems," officials said. How about calling them criminals? ******************************************** ATTACK SIGNATURE RANKING - global IDS, midnight - midnight, previous Day, % of total ******************************************** Suspicious Activity 32.75% Protocol Decode 29.44% Unauthorized Access Attempt 20.65% Denial Of Service 09.68% Pre-Attack Probe 06.48% Back Door 00.99% ******************************************** TOP TEN ATTACK DESTINATION PORTS - global IDS, midnight - midnight, previous day, % of top ten (ports found at) http://www.neohapsis.com/neolabs/neo-ports/neo-ports.html ******************************************** 80 (http) 62.75% 25 (smtp) 13.18% 161 (SNMP) 07.29% 23 (telnet) 05.87% 21 (ftp) 03.05% 69 (tftp) 02.83% 1433 (SQL) 01.63% 515 (printer) 01.26% 31337 (Back Orifice) 01.24% 22 (ssh) 00.91% ******************************************** BACKGROUND, COPYRIGHT NOTICE, and DISCLAIMER ******************************************** Background. We provide this information in the spirit of PDD 63 to help security professionals wage the war against Internet threats more effectively. Information in this update derived primarily from global, real time, 24 x 7 IDS feeds, ISS X-Force R&D Team research, and professional liaison. Other sources as noted. AlertCon 1 reflects the global, malicious, determined, 24 x 7 attacks experienced by all networks. AlertCon 2 means increased vigilance/action recommended due to a specific threat or concern. AlertCon 3 means increased attacks against specific targets or vulnerabilities on a scale that is unusually high, action required. AlertCon 4 reflects an Internet emergency for a target or group of targets whose business continuity may depend on some sort of immediate, decisive action. All summaries cover 24 hours the previous workday, GMT. Monday summaries may cover some weekend activity. Copyright 2002 Internet Security Systems, Inc. Permission is granted for the redistribution of the Internet Risk electronically. It is not to be sold or edited in any way without express consent of ISS. Refer comments or questions to: [EMAIL PROTECTED] or [EMAIL PROTECTED] Disclaimer: This information is subject to change without notice. Use of this information constitutes acceptance for use in an 'as is' condition. There are no warranties with regard to this information. In no event shall the author be liable for any damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk. No other use authorized. FOIA Exemption 4. Patrick Gray Manager, X-Force Internet Threat Intelligence Center Internet Security Systems 6303 Barfield Road Atlanta, GA 30328 -----BEGIN PGP SIGNATURE----- Version: PGP 7.1.1 iQA/AwUBPQnyV5G41ROSQPncEQLHrACfeAYkiP1RfXkj9KTyENOw1SmSp1AAoIUa U/2lNM76XV2E9kR7Qj+n0SZs =WRCX -----END PGP SIGNATURE-----
