RE: [Full-disclosure] Zotob Worm Remover

From: Ron DuFresne (dufresne_at_winternet.com)
Date: 08/23/05

  • Next message: Ron DuFresne: "Re: [Full-disclosure] Problems with unsuscribing" 
    Date: Tue, 23 Aug 2005 12:32:08 -0500 (CDT)
To: Todd Towles <toddtowles@brookshires.com>

    Which is a strong argument for zones, internally a zoned FW structure also
    handles this issue as well. A single chokepoint is not longer effective
    for any org or any decent size. Now layout your network like a bullseye
    and each layer is a zone that requires tighter and tighter contratints to
    reach the softer chewer cernter.

    Patching is a no end no gain issue, when there are weekly sploits released
    to deal with a monthly patch release that takes gawd knows how many days
    or weeks for various companies to test prior to pushing into production.

    Patch managemtn has earned many a lot of bucks, and will continue to line
    many pockets for a long time as folks play into the latest and greatest
    buzzword of the week/month/year, but when it comes to security, a little
    extrapolation of the basics is the real key to any small sense of secure.

    Thanks,

    Ron DuFresne

    On Mon, 22 Aug 2005, Todd Towles wrote:

    > This is correct for the first day, maybe two. Then unpatched laptops
    > leave the corporate network, hit the internet outside the firewall and
    > then bring the worm back right to the heart of the network the very next
    > day, bypassing the firewall all together. Firewall is just one step..it
    > isn't a solve all. Patching would be the only way to stop this threat in
    > all vectors. That was my point.
    >
    > If you aren't blocking 445 on the border of your network, you have must
    > worse problems with Zotob.
    >
    > > -----Original Message-----
    > > From: Ron DuFresne [mailto:dufresne@winternet.com]
    > > Sent: Monday, August 22, 2005 3:15 PM
    > > To: Todd Towles
    > > Cc: n3td3v; full-disclosure@lists.grok.org.uk
    > > Subject: RE: [Full-disclosure] Zotob Worm Remover
    > >
    > > On Mon, 22 Aug 2005, Todd Towles wrote:
    > >
    > > > Wireless really isn't a issue. You can get a worm from a
    > > cat 5 as easy
    > > > as you can from wireless. The problem was they weren't patched. Why
    > > > weren't they patched? Perhaps Change policy slowed them
    > > down, perhaps
    > > > it was the fear of broken programs..perhaps it was the QA group..it
    > > > doesn't really matter. They go the worm because they were
    > > not patched.
    > >
    > > And because they didn't properly filter port 445 is my understanding.
    > > Unpatched systems behind FW's that fliter 445 were untouched.
    > >
    > > Thanks,
    > >
    > > Ron DuFresne
    > > --
    > > "Sometimes you get the blues because your baby leaves you.
    > > Sometimes you get'em 'cause she comes back." --B.B. King
    > > ***testing, only testing, and damn good at it too!***
    > >
    > > OK, so you're a Ph.D. Just don't touch anything.
    > >
    > >
    > >
    > 

    -- 
"Sometimes you get the blues because your baby leaves you. Sometimes you get'em
'cause she comes back." --B.B. King
        ***testing, only testing, and damn good at it too!***
OK, so you're a Ph.D.  Just don't touch anything.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
  • Next message: Ron DuFresne: "Re: [Full-disclosure] Problems with unsuscribing"

    Relevant Pages

    • RE: can ping but not browse
      ... I have stopped the firewall. ... # are safed from all (security) hazards. ... firewall/bastion host to the internet ... # internet and to an internal network, ...
      (Fedora)
    • Re: Using a Linksys router, should I also use Zonealarm?
      ... public internet to access corporate network. ... In the "old days" when people used to use Dial-In instead of VPN you ware ... protected by corporate Firewall -- since there was no public Internet ...
      (microsoft.public.security)
    • RE: Hidden Ports
      ... this is done by the firewalls to prevent authenticated files from being replaced by trojans and connecting to the internet. ... kerio firewall ... or a program that already had network access attempted to ... > Depending on the Access setting for a component, ZoneAlarm Pro ...
      (Security-Basics)
    • Re: Entire Network
      ... Internet access is different and just because a firewall isn't ... Second, if it isn't the firewall, then often it is a case of the system ... any way a network guru. ... > The network connection works just fine from both computers for internet ...
      (microsoft.public.windowsxp.basics)
    • Re: Using a Linksys router, should I also use Zonealarm? Internet Acceptable Use Policy
      ... my browser's access to the Internet is restricted. ... I thought it was the company's firewall extending a slap on my ... > public internet to access corporate network. ... > NAT is Network Address Translation. ...
      (microsoft.public.security)