Feeds

Selfish worm targets month-old Windows flaw

'Find your own vuln. This one's mine'

Intelligent flash storage arrays

More than a month after Microsoft issued an emergency patch for a Windows vulnerability that allows for self-replicating exploits, researchers have spotted a wave of new attacks in the wild that target the critical flaw.

Exploits of MS08-067 have been reported on and off since Microsoft issued the patch in late October, but over the past week, the volume and sophistication of the attacks have grown, according to Ziv Mador, a researcher in Microsoft's Malware Protection Center. His assessment was echoed in reports issued this week by anti-virus providers McAfee and Symantec, the latter which ratcheted up its ThreatCon alert level as a result.

A worm dubbed Conficker.A by Microsoft and Downadup by Symantec is aggressively slithering through corporate networks and home systems alike. It opens up a random port and connects to a server using HTTP. It uses several techniques to obfuscate the attack.

The worm is notable because once it takes hold of a machine it patches the vulnerability to prevent competing attackers from taking hold of the same valuable resource. Infection reports are coming mostly from the US, but other regions, including Western Europe, Japan, China and Brazil, are also affected. Conficker.A avoids infecting PCs based in Ukraine, which is presumably where the attackers are based.

MS08-067 is among the more critical vulnerabilities to hit Windows because on XP versions and earlier a single successful attack can touch off a chain reaction in which other machines on the same network are also compromised. The threat posed by the flaw was so severe Microsoft took the unusual step of issuing an emergency patch outside of its normal update cycle.

It's not surprising that bad guys would target a hole as nasty and gaping as MS08-067. What we still can't fathom is why anyone hasn't yet installed the patch. We're not ones to blame the victim, but anyone attacked by Conficker deserves a generous portion of the responsibility. ®

Top 5 reasons to deploy VMware with Tegile

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.