[转载]Fair warning: 0day Worm Storm Approaching?
<p>信息来源: 邪恶八进制信息安全团队</p><p><span style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><font color="#000000">Exploits... 0days... local root... remote compromise... privilege escalation...</font></span><span style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><font color="#000000"></font></span> </p><p class="MsoNormal" style="MARGIN: 0cm 0cm 0pt"><span style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><font color="#000000">We all hear these terms, but what is the reality and impact of these words, and what can we predict from the near future? Possibilities are rearing their nasty little worm heads, ready to jump up and strike, attacking both the common [ Windows ] systems and not so common ones [ Linux ].</font></span></p><p class="MsoNormal" style="MARGIN: 0cm 0cm 0pt"></p><p><span style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><font color="#000000">On the linux side we see the recent <a href="http://www.securityfocus.com/bid/18874" target="_blank"><strong><font color="#cc0000">PRCTL vulnerability</font></strong></a> and the <a href="http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047913.html" target="_blank"><strong><font color="#cc0000">race condition</font></strong></a> 0day kernel exploits. As I eluded to in a <a href="http://www.zone-h.org/content/view/13869/31/" target="_blank"><strong><font color="#cc0000">past article</font></strong></a> , combining a local root exploit, considered a simple low impact vulnerability [ as classified by some<span> </span>vendors ] with a web application vulnerability, they now becomes a remote root kernel compromise, a form of privilege escalation. If the thought of php, perl and scripting based worms scares you [ remember <a href="http://www.symantec.com/security_response/writeup.jsp?docid=2004-122109-4444-99" target="_blank"><strong><font color="#cc0000">SANTY.A</font></strong></a> ], think of it now as a super worm capable of breaking into whole hosting computers, hosting possibly 1000's of sites, instead of being confined to a single vhost on a server.</font></span> </p><p><span style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><font color="#000000">On the Microsoft side we see several of the newest vulnerabilities and related exploits [ including patched 0days ] that are ripe for becoming the next MsBlaster. While not currently [ to our knowledge ] being mass exploited but [ in our opinion ] very much viable are recent vulnerabilities.</font></span></p><p><span style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><font color="#000000">While having patches available, the sheer volume of deployed Windows systems makes any recent vulnerability rip for the picking as many people do not patch, cannot patch, or wait to patch their systems. Exploits that leverage the <a href="http://www.microsoft.com/technet/security/Bulletin/MS06-025.mspx" target="_blank"><strong><font color="#cc0000">Routing and Remote Access</font></strong></a> and <a href="http://www.microsoft.com/technet/security/Bulletin/MS06-036.mspx" target="_blank"><strong><font color="#cc0000">DHCP Client Service</font></strong></a> vulnerabilities are choice candidates as these services are enabled by default and provide SYSTEM level access [ like root on linux ] to the system once exploited.</font></span><span style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><font color="#000000"></font></span><span style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><font color="#000000"><span></span></font></span></p><p><span style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><font color="#000000">What can you do about it? You could patch your systems! But as we all know, not everyone does or can.</font></span><span style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><font color="#000000"></font></span><span style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><font color="#000000"><span></span></font></span></p><p><span style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><font color="#000000">One channel of thought often raised is that of releasing self patching worms before the bad guys can strike. Yes folks, pre-emptive strikes. A worm that's sole purpose is to find unpatched boxes and automatically patch them! The problem with this approach is twofold, one of ethics and one of the law [ depending on where you live ]. By designing a "patch worm" you are in fact really writing a worm,<span> </span>really releasing a worm and really exploiting systems, which are all highly illegal in some countries. And while you might be doing a "good thing" you are really doing a "bad thing", and we can't have that now... can we?</font></span><span style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><font color="#000000"></font></span><span style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><font color="#000000"><span></span></font></span></p><p><span style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><font color="#000000">Well the bad guys have beat you to the punch on this one. Two of the last big windows worms [ bots actually ] used exploits for Plug-and-Play and Dameware and then utilized a patching component to ensure that the wormed box could not be taken over by another worm using the same exploit. It actually patched the system from being further exploited by the same hole. In this case there were worm / bots wars that targeted competing, previous infestations. Clever.</font></span><span style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><font color="#000000"></font></span><span style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><font color="#000000"><span></span></font></span></p><p><span style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><font color="#000000">While not all vulnerabilities can be guarded against, you can make a difference for those that can<span> </span>and prepare yourself for the next big storm, patch your systems or fear the nasty little worms!</font></span></p>页:
[1]