Signs Point to Worm Attack on SSL Vulnerability

Security experts on Tuesday said they are seeing evidence of what appears to be a worm exploiting the recently announced vulnerability in the Windows implementation of the Secure Sockets Layer (SSL) protocol.

During the morning and early afternoon Tuesday, specialists at VeriSign Inc.s security operations center observed a large-scale exploitation of the vulnerability. While there are a number of software tools available on the Internet to attack the vulnerability, experts said the volume of activity is too great for the attacks to be manual.

“The attacks are too heavy and too regular to be anything but a worm. This has to be a worm or a mass rooter,” said Jerry Brady, chief security officer of managed security services at VeriSign, based in Mountain View, Calif. “The activity is at much too high of a rate for it to be people manually using the exploit.”

The vulnerability, for which Microsoft Corp. released a patch earlier this month, is in an older Microsoft protocol called PCT (Protected Communications Transport). Microsofts SSL library contains a buffer overrun flaw that enables attackers to run arbitrary code on vulnerable machines by sending specially designed PCT handshake packets. PCT is included in the SSL library, which is present in a number of products, including IIS and Exchange Server.

/zimages/5/28571.gifVeriSign and other security services warned of this vulnerability last week.Click hereto read more about the previous alert and the specific action of this exploit.

Brady said the majority of the companys managed services customers who have Internet-facing IIS servers have been attacked already. He added that the company is in the process of breaking down the attacks to see whether they are installing back doors or Trojans on compromised machines.

“Its too soon to tell right now. Were still doing the forensics at this point,” Brady said.

/zimages/5/28571.gifCheck outeWEEK.coms Security Centerat http://security.eweek.com for security news, views and analysis. Be sure to add our eWEEK.com security news feed to your RSS newsreader or My Yahoo page:/zimages/5/19420.gifhttp://us.i1.yimg.com/us.yimg.com/i/us/my/addtomyyahoo2.gif