Signs Point to Worm Attack on SSL Vulnerability

R. A. Hettinga rah at shipwright.com
Thu Apr 29 11:31:08 PDT 2004


<http://www.eweek.com/print_article/0,1761,a=125527,00.asp>

EWeek


Signs Point to Worm Attack on SSL Vulnerability

April 27, 2004
 By   Dennis Fisher

Security experts on Tuesday said they are seeing evidence of what appears
to be a worm exploiting the recently announced vulnerability in the Windows
implementation of the Secure Sockets Layer (SSL) protocol.

 During the morning and early afternoon Tuesday, specialists at VeriSign
Inc.'s security operations center observed a large-scale exploitation of
the vulnerability. While there are a number of software tools available on
the Internet to attack the vulnerability, experts said the volume of
activity is too great for the attacks to be manual.

 ADVERTISEMENT

"The attacks are too heavy and too regular to be anything but a worm. This
has to be a worm or a mass rooter," said Jerry Brady, chief security
officer of managed security services at VeriSign, based in Mountain View,
Calif. "The activity is at much too high of a rate for it to be people
manually using the exploit."

 The vulnerability, for which Microsoft Corp. released a patch earlier this
month, is in an older Microsoft protocol called PCT (Protected
Communications Transport). Microsoft's SSL library contains a buffer
overrun flaw that enables attackers to run arbitrary code on vulnerable
machines by sending specially designed PCT handshake packets. PCT is
included in the SSL library, which is present in a number of products,
including IIS and Exchange Server.

VeriSign and other security services warned of this vulnerability last
week. Click here to read more about the previous alert and the specific
action of this exploit.

Brady said the majority of the company's managed services customers who
have Internet-facing IIS servers have been attacked already. He added that
the company is in the process of breaking down the attacks to see whether
they are installing back doors or Trojans on compromised machines.

 "It's too soon to tell right now. We're still doing the forensics at this
point," Brady said.


-- 
-----------------
R. A. Hettinga <mailto: rah at ibuc.com>
The Internet Bearer Underwriting Corporation <http://www.ibuc.com/>
44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'





More information about the cypherpunks-legacy mailing list