Careers & Certifications

07:37 PM
Connect Directly
RSS
E-Mail
50%
50%

Hackers Renew Windows 'MS06-040' Attacks

Symantec and the Internet Storm Center have alerted users to increased activity which could indicate a new round of spybot and worm attacks exploiting a Windows Server security vulnerability.

An upswing in activity related to a potential Windows Server vulnerability dubbed with a most-dangerous label in early August has been detected by security companies and organizations.

That earlier vulnerability came to light August 8, amid Microsoft's release of a dozen security bulletins. These included MS06-040, which patched a critical vulnerability in Windows' Server service. At the time, security analysts warned that the bug might be exploited by a network-attacking worm, ala MSBlast. Although several exploits appeared, their impact was minor.

On Thursday, both Symantec and the SANS Institute's Internet Storm Center alerted users that they had detected a significant increase worldwide in activity on port 139, one of the two ports which an exploit against the MS06-040 vulnerability would use to attack systems.

The Internet Storm Center (ISC) spotted a major spike in port 139 activity starting Sunday, Aug. 27, while Symantec's sensor network recorded large increases on both Tuesday, Aug. 29 and Wednesday, Aug. 30. According to Symantec, the systems attacking port 139 were also involved in attacks on port 445, the other likely route attackers exploiting the Server service would use.

"There could be several possibilities for this," said Lorna Hutcheson, an analyst with the ISC, in an online note. But she discounted earlier bots that had circulated soon after MS06-040 was released. "Both were [recognized] on August 14, so they have been around for a whileand this upswing just started over the past couple of days," Hutcheson wrote. Generally, a jump in activity against one or more of Windows' ports means that attackers are scanning the Internet for vulnerable systems.

Previous
1 of 3
Next
Comment  | 
Print  | 
More Insights
Cartoon
Slideshows
Audio Interviews
Archived Audio Interviews
Jeremy Schulman, founder of Schprockits, a network automation startup operating in stealth mode, joins us to explore whether networking professionals all need to learn programming in order to remain employed.
White Papers
Register for Network Computing Newsletters
Current Issue
Video
Twitter Feed