<http://www.eweek.com/print_article/0,1761,a=125527,00.asp> EWeek Signs Point to Worm Attack on SSL Vulnerability April 27, 2004 By Dennis Fisher Security experts on Tuesday said they are seeing evidence of what appears to be a worm exploiting the recently announced vulnerability in the Windows implementation of the Secure Sockets Layer (SSL) protocol. During the morning and early afternoon Tuesday, specialists at VeriSign Inc.'s security operations center observed a large-scale exploitation of the vulnerability. While there are a number of software tools available on the Internet to attack the vulnerability, experts said the volume of activity is too great for the attacks to be manual. ADVERTISEMENT "The attacks are too heavy and too regular to be anything but a worm. This has to be a worm or a mass rooter," said Jerry Brady, chief security officer of managed security services at VeriSign, based in Mountain View, Calif. "The activity is at much too high of a rate for it to be people manually using the exploit." The vulnerability, for which Microsoft Corp. released a patch earlier this month, is in an older Microsoft protocol called PCT (Protected Communications Transport). Microsoft's SSL library contains a buffer overrun flaw that enables attackers to run arbitrary code on vulnerable machines by sending specially designed PCT handshake packets. PCT is included in the SSL library, which is present in a number of products, including IIS and Exchange Server. VeriSign and other security services warned of this vulnerability last week. Click here to read more about the previous alert and the specific action of this exploit. Brady said the majority of the company's managed services customers who have Internet-facing IIS servers have been attacked already. He added that the company is in the process of breaking down the attacks to see whether they are installing back doors or Trojans on compromised machines. "It's too soon to tell right now. We're still doing the forensics at this point," Brady said. -- ----------------- R. A. Hettinga <mailto: rah@ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'