Signs Point to Worm Attack on SSL Vulnerability
Security experts report seeing evidence of a significant worm attack forming on the Internet. The attack is exploiting a previously known vulnerability in Windows' SSL implementation.Security experts on Tuesday said they are seeing evidence of what appears to be a worm exploiting the recently announced vulnerability in the Windows implementation of the Secure Sockets Layer (SSL) protocol. During the morning and early afternoon Tuesday, specialists at VeriSign Inc.s security operations center observed a large-scale exploitation of the vulnerability. While there are a number of software tools available on the Internet to attack the vulnerability, experts said the volume of activity is too great for the attacks to be manual. "The attacks are too heavy and too regular to be anything but a worm. This has to be a worm or a mass rooter," said Jerry Brady, chief security officer of managed security services at VeriSign, based in Mountain View, Calif. "The activity is at much too high of a rate for it to be people manually using the exploit."
The vulnerability, for which Microsoft Corp. released a patch earlier this month, is in an older Microsoft protocol called PCT (Protected Communications Transport). Microsofts SSL library contains a buffer overrun flaw that enables attackers to run arbitrary code on vulnerable machines by sending specially designed PCT handshake packets. PCT is included in the SSL library, which is present in a number of products, including IIS and Exchange Server.