Signs Point to Worm Attack on SSL Vulnerability

Security experts report seeing evidence of a significant worm attack forming on the Internet. The attack is exploiting a previously known vulnerability in Windows' SSL implementation.

Security experts on Tuesday said they are seeing evidence of what appears to be a worm exploiting the recently announced vulnerability in the Windows implementation of the Secure Sockets Layer (SSL) protocol.

During the morning and early afternoon Tuesday, specialists at VeriSign Inc.s security operations center observed a large-scale exploitation of the vulnerability. While there are a number of software tools available on the Internet to attack the vulnerability, experts said the volume of activity is too great for the attacks to be manual.

"The attacks are too heavy and too regular to be anything but a worm. This has to be a worm or a mass rooter," said Jerry Brady, chief security officer of managed security services at VeriSign, based in Mountain View, Calif. "The activity is at much too high of a rate for it to be people manually using the exploit."

Resource Library:

The vulnerability, for which Microsoft Corp. released a patch earlier this month, is in an older Microsoft protocol called PCT (Protected Communications Transport). Microsofts SSL library contains a buffer overrun flaw that enables attackers to run arbitrary code on vulnerable machines by sending specially designed PCT handshake packets. PCT is included in the SSL library, which is present in a number of products, including IIS and Exchange Server.

VeriSign and other security services warned of this vulnerability last week. Click here to read more about the previous alert and the specific action of this exploit.

Brady said the majority of the companys managed services customers who have Internet-facing IIS servers have been attacked already. He added that the company is in the process of breaking down the attacks to see whether they are installing back doors or Trojans on compromised machines.

"Its too soon to tell right now. Were still doing the forensics at this point," Brady said.

Check out eWEEK.coms Security Center at http://security.eweek.com for security news, views and analysis. Be sure to add our eWEEK.com security news feed to your RSS newsreader or My Yahoo page:  

Reader Comments: Signs Point to Worm Attack on SSL Vulnerability >>> Be the FIRST to comment on this article!

>>> More Network Security & Hardware Articles          >>> More By Dennis Fisher