full-disclosure - Zotob Worm Remover

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue Aug 23 18:32:19 2005
From: dufresne at winternet.com (Ron DuFresne)
Subject: Zotob Worm Remover

Which is a strong argument for zones, internally a zoned FW structure also
handles this issue as well.  A single chokepoint is not longer effective
for any org or any decent size.  Now layout your network like a bullseye
and each layer is a zone that requires tighter and tighter contratints to
reach the softer chewer cernter.

Patching is a no end no gain issue, when there are weekly sploits released
to deal with a monthly patch release that takes gawd knows how many days
or weeks for various companies to test prior to pushing into production.

Patch managemtn has earned many a lot of bucks, and will continue to line
many pockets for a long time as folks play into the latest and greatest
buzzword of the week/month/year, but when it comes to security, a little
extrapolation of the basics is the real key to any small sense of secure.

Thanks,

Ron DuFresne

On Mon, 22 Aug 2005, Todd Towles wrote:

> This is correct for the first day, maybe two. Then unpatched laptops
> leave the corporate network, hit the internet outside the firewall and
> then bring the worm back right to the heart of the network the very next
> day, bypassing the firewall all together. Firewall is just one step..it
> isn't a solve all. Patching would be the only way to stop this threat in
> all vectors. That was my point.
>
> If you aren't blocking 445 on the border of your network, you have must
> worse problems with Zotob.
>
> > -----Original Message-----
> > From: Ron DuFresne [mailto:dufresne@...ternet.com]
> > Sent: Monday, August 22, 2005 3:15 PM
> > To: Todd Towles
> > Cc: n3td3v; full-disclosure@...ts.grok.org.uk
> > Subject: RE: [Full-disclosure] Zotob Worm Remover
> >
> > On Mon, 22 Aug 2005, Todd Towles wrote:
> >
> > > Wireless really isn't a issue. You can get a worm from a
> > cat 5 as easy
> > > as you can from wireless. The problem was they weren't patched. Why
> > > weren't they patched? Perhaps Change policy slowed them
> > down, perhaps
> > > it was the fear of broken programs..perhaps it was the QA group..it
> > > doesn't really matter. They go the worm because they were
> > not patched.
> >
> > And because they didn't properly filter port 445 is my understanding.
> > Unpatched systems behind FW's that fliter 445 were untouched.
> >
> > Thanks,
> >
> > Ron DuFresne
> > --
> > "Sometimes you get the blues because your baby leaves you.
> > Sometimes you get'em 'cause she comes back." --B.B. King
> >         ***testing, only testing, and damn good at it too!***
> >
> > OK, so you're a Ph.D.  Just don't touch anything.
> >
> >
> >
>

-- 
"Sometimes you get the blues because your baby leaves you. Sometimes you get'em
'cause she comes back." --B.B. King
        ***testing, only testing, and damn good at it too!***

OK, so you're a Ph.D.  Just don't touch anything.