Computer Security Update Bob Cowles, SLAC stanford.edu Presented at HEPiX - TRIUMF 23 Oct 2003 Work supported by U. S. Department of Energy contract DE-AC03-76SF00515

23 Oct 2003HEPiX - TRIUMF2

23 Oct 2003HEPiX - TRIUMF3 Slammer Impact

23 Oct 2003HEPiX - TRIUMF4 Australia Japan Korea China India

23 Oct 2003HEPiX - TRIUMF5

23 Oct 2003HEPiX - TRIUMF6

23 Oct 2003HEPiX - TRIUMF7 MSBlaster Released MSBlaster at SLAC

23 Oct 2003HEPiX - TRIUMF8 FireWall Log – Infected Machines Sep 16 18:29:18 icmp > (8/0) Sep 16 18:29:19 icmp > (8/0) Sep 16 18:29:20 icmp > (8/0) Sep 16 18:38:46 tcp (3325) -> (135) Sep 16 18:38:47 tcp (3169) -> (135) Sep 16 18:38:48 tcp (3249) -> (135) Sep 16 18:40:06 icmp > (8/0) Sep 16 18:40:06 icmp > (8/0) Sep 16 18:40:07 icmp > (8/0) Sep 16 18:40:17 tcp (4107) -> (135) Sep 16 18:40:18 tcp (4194) -> (135) Sep 16 18:40:19 tcp (4292) -> (135) Sep 16 22:28:25 tcp (4413) -> (135) Sep 16 22:28:26 tcp (4377) -> (135) Sep 16 22:28:27 tcp (4383) -> (135)

23 Oct 2003HEPiX - TRIUMF9 Infection SLAC 32%VPN 22%DHCP (reg, internal network) 20%Fixed IP On vacation, laptop infected outside, etc. 14%Infected during build / patch 12%Dialup

23 Oct 2003HEPiX - TRIUMF10 Blaster - Easy to Get Infected 09/29/103 11:46:42 Host: Port: 135 TCP Blocked 09/29/103 11:46:41 Host: Port: 135 TCP Blocked 12:21pm: Bob, is host "illusion" yours, as per my so-called memory? But the mac addr is registered to Richard Mount... Sep 29 11:41:37 dhcp2 dhcpd: DHCPACK on to 00:10:a4:e4:2a:b8 (illusion) host roam-rmount2 { hardware ethernet 00:10:a4:e4:2a:b8; }# 01/25/00 # PC54566, Richard Mount

23 Oct 2003HEPiX - TRIUMF11

23 Oct 2003HEPiX - TRIUMF12

23 Oct 2003HEPiX - TRIUMF13

23 Oct 2003HEPiX - TRIUMF14

23 Oct 2003HEPiX - TRIUMF15

23 Oct 2003HEPiX - TRIUMF16

23 Oct 2003HEPiX - TRIUMF17

23 Oct 2003HEPiX - TRIUMF18

23 Oct 2003HEPiX - TRIUMF19

23 Oct 2003HEPiX - TRIUMF20

23 Oct 2003HEPiX - TRIUMF21

23 Oct 2003HEPiX - TRIUMF22

23 Oct 2003HEPiX - TRIUMF23 It Sucks Not to Patch Popular rookit in many variations Hides files, directories, processes; precompiled password With keyboard and/or ssh sniffers Listens on *all* open ports for backdoor Any port open inbound allows backdoor signal, sk thens opens outbound tcp for encrypted shell connection

23 Oct 2003HEPiX - TRIUMF24 suckit (cont) Home page Latest versions not publicly available Also find exploits for –ptrace –sendmail 8.11.x

23 Oct 2003HEPiX - TRIUMF25 Last 24 Hours Last 30 Days

23 Oct 2003HEPiX - TRIUMF26 Gartner ITXpo Windows has fewer vulnerabilities than RH Linux [RH6] No roadmap for Linux. There’s nobody to hold accountable for security issues The security of Microsoft products is our top priority. We have our best brains on it. We understand this is an issue of customer satisfaction.

23 Oct 2003HEPiX - TRIUMF27 Stanford Universities tend to be a worst case Diverse, unmanaged –Population –Hardware –Software Unlikely to fit into AD model Stanford had 8000 machines compromised by Blaster BEFORE students returned for classes

23 Oct 2003HEPiX - TRIUMF28 Feedback to Microsoft Clear & meaningful impact statements Fix IE (30+ outstanding bugs) Reduce the attack vector (profile services) Don’t require license check for security patches (e. g. MS Office CD) No tie-in to IE (no active scripting)

23 Oct 2003HEPiX - TRIUMF29 Feedback to Microsoft (cont) Open up patching tools and process Understand 3 rd party tools +/- Allow other vendors to use same tools for their Windows products Provide feedback on real patch status (local & remote) Need general patch deployment tool not requiring AD

23 Oct 2003HEPiX - TRIUMF30 Conclusions [Unchanged from last year] Poor administration is still a major problem Firewalls cannot substitute for patches Multiple levels of virus/worm protection are necessary Clue is more important than open source

23 Oct 2003HEPiX - TRIUMF31 No Easy Solutions Questions?