Fergie's Tech Blog

Hackers Said To Be Close To Windows 2000 Worm

Greg Keizer writes in TechWeb News:

Just three days after Microsoft disclosed multiple critical vulnerabilities in Windows, exploit code for one of the most dangerous has appeared on the Internet. Security firms sent out alerts warning Windows 2000 users to patch ASAP or risk a worm attack in the near future.

"I don't think [Windows 2000] users have an awful lot of time to patch," said Gunter Ollmann, the director of Internet Security Systems' (ISS) X-force research group. "We'll most certainly see a worm using this exploit," he added.

There's also evidence that hackers are trying to develop code that would successfully attack less-vulnerable Windows XP SP1 machines, Ollmann said. In any case, the clock is ticking. "What's out there now puts this on the level of script kiddies," said Ollmann, using the term for less experienced, less technically-astute hackers.

The patch for the Plug and Play bug was issued Tuesday as bulletin MS05-039 by Microsoft. The bulletin outlined how an anonymous user could grab control of a Windows 2000 machine by sending a specially-crafted message. No user interaction would be required, making the bug a potential hole that hackers could use to create a fast-spreading, destructive worm like earlier network attacks by Slammer or MSBlast.

Multiple security vendors rushed to alert customers and others of the new danger.

posted by Fergie @ 8/12/2005 03:34:00 PM