Full Disclosure mailing list archives
RE: Zotob Worm Remover
From: "Jan Nielsen" <jan () boyakasha dk>
Date: Mon, 22 Aug 2005 22:58:53 +0200
Todd, i would have to disagree with you on this issue, patching in my book is not any kind of definite answer to these types of problems, endpoint behaviour security is something that I lean more towards. This would enable you to define a set of generic behavioural patterns for processes running on your machine, and would be a much better defence against things you don't know about yet. I myself have an agent with a few basic O/S rules like : - No application may write other applications memory space - No application may inject code into other programs (dll hooks and such) - No application may access system functions from code executing in data or stack space - No application may capture keystrokes This does quite abit to protect my laptop from unknown attacks, since in my findings, this is the way most (if not all) attacks enter a host. I would tell you what software I use but that would make this more of a sales bulletin than an actual security related opinion. just my 2 cents Jan -----Original Message----- From: Todd Towles [mailto:toddtowles () brookshires com] Sent: 22. august 2005 22:22 To: Ron DuFresne Cc: full-disclosure () lists grok org uk Subject: RE: [Full-disclosure] Zotob Worm Remover This is correct for the first day, maybe two. Then unpatched laptops leave the corporate network, hit the internet outside the firewall and then bring the worm back right to the heart of the network the very next day, bypassing the firewall all together. Firewall is just one step..it isn't a solve all. Patching would be the only way to stop this threat in all vectors. That was my point. If you aren't blocking 445 on the border of your network, you have must worse problems with Zotob.
-----Original Message----- From: Ron DuFresne [mailto:dufresne () winternet com] Sent: Monday, August 22, 2005 3:15 PM To: Todd Towles Cc: n3td3v; full-disclosure () lists grok org uk Subject: RE: [Full-disclosure] Zotob Worm Remover On Mon, 22 Aug 2005, Todd Towles wrote:Wireless really isn't a issue. You can get a worm from acat 5 as easyas you can from wireless. The problem was they weren't patched. Why weren't they patched? Perhaps Change policy slowed themdown, perhapsit was the fear of broken programs..perhaps it was the QA group..it doesn't really matter. They go the worm because they werenot patched. And because they didn't properly filter port 445 is my understanding. Unpatched systems behind FW's that fliter 445 were untouched. Thanks, Ron DuFresne -- "Sometimes you get the blues because your baby leaves you. Sometimes you get'em 'cause she comes back." --B.B. King ***testing, only testing, and damn good at it too!*** OK, so you're a Ph.D. Just don't touch anything.
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- RE: Zotob Worm Remover Todd Towles (Aug 22)
- Re: Zotob Worm Remover n3td3v (Aug 22)
- <Possible follow-ups>
- RE: Zotob Worm Remover Todd Towles (Aug 22)
- Re: Zotob Worm Remover n3td3v (Aug 22)
- Re: Zotob Worm Remover Ill will (Aug 22)
- RE: Zotob Worm Remover Ron DuFresne (Aug 22)
- RE: Zotob Worm Remover Todd Towles (Aug 22)
- RE: Zotob Worm Remover Todd Towles (Aug 22)
- RE: Zotob Worm Remover Jan Nielsen (Aug 22)
- RE: Zotob Worm Remover Aditya Deshmukh (Aug 22)
- Re: Zotob Worm Remover James Tucker (Aug 22)
- Re: Zotob Worm Remover Stuart Low (Aug 22)
- Re: Zotob Worm Remover Valdis . Kletnieks (Aug 22)
- Re: Zotob Worm Remover pingywon (Aug 22)
- RE: Zotob Worm Remover Jan Nielsen (Aug 22)
- RE: Zotob Worm Remover Ron DuFresne (Aug 23)
- Re: Zotob Worm Remover MadHat (Aug 23)