Experts Warn of New Worm Threat
By Brian Krebs
Microsoft Corp. is warning consumers that it discovered new security holes
in its Windows operating system that could be exploited by an Internet worm
similar to the "Blaster" worm that infected more than a half-million
computers last month.
Security experts cautioned that a new worm could emerge within several
hours or days, and could be far more damaging than Blaster.
"We got really lucky that Blaster didn't try to delete files or render
computers otherwise unusable," said Vimal Solanki, senior product marketing
manager for Santa Clara, Calif., anti-virus software designer Network
Associates. "It's really up to your imagination what hackers could do with
this flaw."
Microsoft urged consumers to immediately download and install free software
from its Web site to patch the vulnerabilities. The Department of Homeland
Security also issued an advisory about the security holes.
The problems reside in services deeply woven into the fabric of the Windows
operating system that allow users to communicate across Microsoft networks.
Microsoft labeled both flaws "critical," meaning they could be easily
exploited by an Internet worm, a program that spreads rapidly across the
Internet without any action on the part of the user.
"We're urging all Microsoft users to patch their systems as soon as
possible, because -- whether or not we do see a worm that takes advantage of
this -- hackers could still use the vulnerability to execute whatever
programs they wanted to on a user's machine," said Stephen Toulouse, a
program manager at Microsoft's security response center.
Alfred Huger, senior director of engineering at Symantec Security Response,
said his company has observed several exploits already in circulation within
online hacker channels. Huger said Cupertino Calif.-based Symantec's own
security researchers figured out how to alter the Blaster exploit for use
against the most recent security hole.
"It certainly would not be a great leap forward to modify Blaster to fit
this current problem," Huger said. "With this new security hole, we're
looking at the exact same situation [as with Blaster], except that far fewer
people are currently patched against it."
"This is pretty much identical to the issue that spawned the Blaster worm,"
said Art Manion, an Internet security analyst with the CERT Coordination
Center, a government-funded security watchdog group at Carnegie Mellon
University in Pittsburgh.
Microsoft on July 16 advised users to patch their computers to prevent
worms like Blaster. One week later, computer code to exploit the security
hole was posted online. Less than two weeks after that, the first of several
Blaster worms hit the Internet.
Dan Ingevaldson, engineering manager for Atlanta-based Internet Security
Systems's X-Force research development group, said the window of opportunity
for users to patch their systems would likely be far shorter this time
because hackers already know how the vulnerable service interacts with the
Windows operating system.
"It's not going to take a real genius to cobble together a new attack,"
Ingevaldson said.
Many large Internet service providers have installed filters to block
Blaster-like Web traffic, which could lessen the damage caused by a new
worm, said Manion of CERT.
© 2003 The Washington Post Company
|
