[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.43.0508231226540.15367-100000@tundra.winternet.com>
Date: Tue Aug 23 18:32:19 2005
From: dufresne at winternet.com (Ron DuFresne)
Subject: Zotob Worm Remover
Which is a strong argument for zones, internally a zoned FW structure also
handles this issue as well. A single chokepoint is not longer effective
for any org or any decent size. Now layout your network like a bullseye
and each layer is a zone that requires tighter and tighter contratints to
reach the softer chewer cernter.
Patching is a no end no gain issue, when there are weekly sploits released
to deal with a monthly patch release that takes gawd knows how many days
or weeks for various companies to test prior to pushing into production.
Patch managemtn has earned many a lot of bucks, and will continue to line
many pockets for a long time as folks play into the latest and greatest
buzzword of the week/month/year, but when it comes to security, a little
extrapolation of the basics is the real key to any small sense of secure.
Thanks,
Ron DuFresne
On Mon, 22 Aug 2005, Todd Towles wrote:
> This is correct for the first day, maybe two. Then unpatched laptops
> leave the corporate network, hit the internet outside the firewall and
> then bring the worm back right to the heart of the network the very next
> day, bypassing the firewall all together. Firewall is just one step..it
> isn't a solve all. Patching would be the only way to stop this threat in
> all vectors. That was my point.
>
> If you aren't blocking 445 on the border of your network, you have must
> worse problems with Zotob.
>
> > -----Original Message-----
> > From: Ron DuFresne [mailto:dufresne@...ternet.com]
> > Sent: Monday, August 22, 2005 3:15 PM
> > To: Todd Towles
> > Cc: n3td3v; full-disclosure@...ts.grok.org.uk
> > Subject: RE: [Full-disclosure] Zotob Worm Remover
> >
> > On Mon, 22 Aug 2005, Todd Towles wrote:
> >
> > > Wireless really isn't a issue. You can get a worm from a
> > cat 5 as easy
> > > as you can from wireless. The problem was they weren't patched. Why
> > > weren't they patched? Perhaps Change policy slowed them
> > down, perhaps
> > > it was the fear of broken programs..perhaps it was the QA group..it
> > > doesn't really matter. They go the worm because they were
> > not patched.
> >
> > And because they didn't properly filter port 445 is my understanding.
> > Unpatched systems behind FW's that fliter 445 were untouched.
> >
> > Thanks,
> >
> > Ron DuFresne
> > --
> > "Sometimes you get the blues because your baby leaves you.
> > Sometimes you get'em 'cause she comes back." --B.B. King
> > ***testing, only testing, and damn good at it too!***
> >
> > OK, so you're a Ph.D. Just don't touch anything.
> >
> >
> >
>
--
"Sometimes you get the blues because your baby leaves you. Sometimes you get'em
'cause she comes back." --B.B. King
***testing, only testing, and damn good at it too!***
OK, so you're a Ph.D. Just don't touch anything.
Powered by blists - more mailing lists