RE: New article on SecurityFocus

["Brady McClenon" <BMcClenon () uamail albany edu>]

The question is whether the knoppix web server was compromised, or if an
untrustworthy employee just threw it out there.  Are we seeing, or have
seen, any worm-like activity with this vulnerability?  If so, how
rampant is it?  We here in the news that it's all over... Hundreds!....
Thousands!... But yet ask any one to name a site or confirm they have
first hand experience, or have a friend or colleague with fist hand
experience and all you get is them naming one of a handful of sites we
all heard about through media reports.  I'm not saying this isn't a real
threat.  I'm saying I believe it's exploit distribution has been greatly
exaggerated.
 

> -----Original Message-----
> From: Murad Talukdar [mailto:talukdar_m () subway com] 
> Sent: Sunday, January 08, 2006 10:20 PM
> To: Brady McClenon; 'Drew Simonis'; 'Thor (Hammer of God)'; 
> 'Erin Carroll'; pen-test () securityfocus com
> Cc: 'Larry Seltzer'; focus-ms () securityfocus com
> Subject: RE: New article on SecurityFocus
>
> That was it; SANS
> http://handlers.dshield.org/jullrich/wmffaq.html
> So it can even get onto 'Trusted' websites.
> (At least they are saying they had a 'report').
> Digital whispers....
>
>
> Regards
> Murad Talukdar
>
> -----Original Message-----
> From: Brady McClenon [mailto:BMcClenon () uamail albany edu] 
> Sent: Saturday, January 07, 2006 2:29 AM
> To: Drew Simonis; Thor (Hammer of God); Erin Carroll;
> pen-test () securityfocus com
> Cc: Larry Seltzer; focus-ms () securityfocus com
> Subject: RE: New article on SecurityFocus
>
> Just curious.  I hear media reports and people saying that there's
> hundreds or thousands of compromised web site from this, but 
> I have ask
> where these numbers come from?  Where is this data, or is it pure
> speculation?  I'm also curious how one could compromise a web server
> with this exploit.  Putting files on a web server to dole out and
> compromise other computers I can see, but is the web server really
> compromised in this case?  If so, was it by way of the WMF exploit?
>
> One last question:  Has anyone here experienced or know 
> anyone that has
> a "legitimate" web server compromised (or serving out) by the WMF
> exploit.  I'm trying to determine if there are those with actual
> knowledge that the sky is indeed falling, or if we are all 
> shaking over
> unsubstantiated media hype.
>
>
> > -----Original Message-----
> > From: Drew Simonis [mailto:simonis () myself com] 
> > Sent: Friday, January 06, 2006 10:22 AM
> > To: Thor (Hammer of God); Erin Carroll; pen-test () securityfocus com
> > Cc: Larry Seltzer; focus-ms () securityfocus com
> > Subject: Re: New article on SecurityFocus
> >
> > > Overall, I think community's coverage of wmf has been delivered 
> > > with an ounce of perception, and a pound of obscurity.  
> It's almost 
> > > as if people *want* it to be worse than it is.  I'm not 
> surprised, 
> > > of course.  But regardless,  my call is that we'll see a little 
> > > activity here and there, the patch will come out, most 
> will install 
> > > it (or have it installed automatically) and the whole issue will 
> > > fade away.  But that's all.
> > >
> > > We'll know for sure shortly, either way.
> >
> > Thor,
> > I think your path of thought is stuck a bit in the past.  
> > Worms are neat as a technical exercise, but we see more and 
> > more that the attackers are increasingly aware of the value 
> > of these vulnerabilities from a financial perspective, not 
> > merely for notoriety.  As such, it benefits the attacker to 
> > have a less subtle attack, one that does not sensationalize 
> > the vulnerability.  Complacency is their ally.  
> >
> > That said, there are already numerous (hundreds+) 
> > "legitimate" web sites that have been compromised and had 
> > exploit images injected into their content.  There are also 
> > already hundreds of thousands of machines that have been 
> > infected with Trojans or bots.  These infected machines will 
> > patch, but they won't be safe, and the problem gets worse.  
> >
> > So no, there won't be some catastrophic worm event.  But I 
> > posit that what there will be could be much worse.  
> >
> > -- 
> > ___________________________________________________
> > Play 100s of games for FREE! http://games.mail.com/
> >
> >
> > --------------------------------------------------------------
> > -------------
> > --------------------------------------------------------------
> > -------------
>
> --------------------------------------------------------------
> -------------
> --------------------------------------------------------------
> -------------

------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner:

Hackers are concentrating their efforts on attacking applications on your
website. Up to 75% of cyber attacks are launched on shopping carts, forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
futile against web application hacking. Check your website for vulnerabilities
to SQL injection, Cross site scripting and other web attacks before hackers do!
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------