IoT
News
News
8/31/2006
03:37 PM
50%
50%
RELATED EVENTS
The Analytics Job and Salary Outlook for 2016
Jan 28, 2016
With data science and big data top-of-mind for all types of organizations, hiring analytics profes ...Read More>>

They're Baaack! Hackers Renew Windows 'MS06-040' Attacks

Two security companies say they have detected a significant increase in activity on one of two ports that an exploit against the MS06-040 vulnerability would use in an attack.

An upswing in activity related to a potential Windows Server vulnerability dubbed with a most-dangerous label in early August has been detected by security companies and organizations.

That earlier vulnerability came to light August 8, amid Microsoft's release of a dozen security bulletins. These included MS06-040, which patched a critical vulnerability in Windows' Server service. At the time, security analysts warned that the bug might be exploited by a network-attacking worm, ala MSBlast. Although several exploits appeared, their impact was minor.

On Thursday, both Symantec and the SANS Institute's Internet Storm Center alerted users that they had detected a significant increase worldwide in activity on port 139, one of the two ports which an exploit against the MS06-040 vulnerability would use to attack systems.

The Internet Storm Center (ISC) spotted a major spike in port 139 activity starting Sunday, Aug. 27, while Symantec's sensor network recorded large increases on both Tuesday, Aug. 29 and Wednesday, Aug. 30. According to Symantec, the systems attacking port 139 were also involved in attacks on port 445, the other likely route attackers exploiting the Server service would use.

"There could be several possibilities for this," said Lorna Hutcheson, an analyst with the ISC, in an online note. But she discounted earlier bots that had circulated soon after MS06-040 was released. "Both were [recognized] on August 14, so they have been around for a whileand this upswing just started over the past couple of days," Hutcheson wrote. Generally, a jump in activity against one or more of Windows' ports means that attackers are scanning the Internet for vulnerable systems.

Symantec's analysis was more specific in pegging possible causes for the uptick in port 139 activity.

"A new variant of Spybot named W32.Spybot.AKNO has been discovered propagating in the wild," Symantec said in a warning issued early Thursday to users of its DeepSight threat management service. The bot -- designed to infiltrate a system, then download additional malicious code to hijack the computer so it can be used as a spam zombie or for other criminal activities -- also contains a rootkit component, Symantec added. A rootkit is code that cloaks a worm or bot to make it harder for anti-virus software to both detect and delete the malware.

"That Spybot picked this up [an MS06-040 exploit] isn't surprising," said David Cole, the director of Symantec's security response team. "Spybot is one of the most prevalent bots out there. What is interesting is that it also threw in rootkit capabilities."

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Register for InformationWeek Newsletters
White Papers
Current Issue
How to Knock Down Barriers to Effective Risk Management
Risk management today is a hodgepodge of systems, siloed approaches, and poor data collection practices. That isn't how it should be.
Video
Slideshows
Twitter Feed
InformationWeek Radio
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.