I've long recommended to my clients that they stay within Microsoft's life cycle with respect to their Windows operating systems. Most of them, even after explaining it, I suspect deep down they think it's a scheme to extort more money out of them to upgrade. Well, here's a perfect example to backup my claims.
This is why NO ONE should be running Windows 2000 or Millennium (ME) anymore (or earlier, i.e. 98, NT, 95, etc). The last sentence sums it up very nicely. Even with a current anti-virus subscription, you are NOT protected!
"Recently, the Conficker/Downadup worm infected several hundred machines and critical medical equipment in an undisclosed number of US hospitals. The attacks were not widespread; however, Marcus Sachs, director of the SANS Internet Storm Center, told CNET News that it raises the awareness of what we would do if there were millions of computers infected in hospitals or in critical infrastructure locations. It's not clear how the devices (including heart monitors, MRI machines and PCs) got infected. Infected computers were running Windows NT and Windows 2000 in a local area network (LAN) that wasn't supposed to be Internet accessible, but the LAN was connected to one with direct Internet access. A patch was released by Microsoft last October by November that fixes the problem, but the computers infected were reportedly too old to be patched."
Researchers Find Massive Botnet On Nearly 2 Million Infected Consumer, Business, Government PCs
More than 70 government-owned domains hit, and nearly half of the overall infections are in the U.S.
Researchers have discovered a major botnet operating out of the Ukraine that has infected 1.9 million machines, including large corporate and government PCs mainly in the U.S.
The botnet, which appears to be larger than the infamous Storm botnet was in its heyday, has infected machines from some 77 government-owned domains -- 51 of which are U.S. government ones, according to Ophir Shalltin, marketing director of Finjan, which recently found the botnet. Shalltin says the botnet is controlled by six individuals and is hosted in Ukraine.
Aside from its massive size and scope, what is also striking about the botnet is what its malware can do to an infected machine. The malware lets an attacker read the victim's email, communicate via HTTP in the botnet, inject code into other processes, visit Websites without the user knowing, and register as a background service on the infected machine, for instance. The bots communicate with their command and control systems via HTTP.
Botnet expert Joe Stewart says it appears to be similar to other downloader-type botnets. "It looks a lot like other downloader bots out there," says Stewart, director of malware research for SecureWorks. "It has a system for installing other malware and getting paid for it. The first stage is to get the bot piece onto the machine, and then they get paid to install other malware."
Finjan says victims are infected when visiting legitimate Websites containing a Trojan that the company says is detected by only four of 39 anti-malware tools, according to a VirusTotal report run by Finjan researchers.
"We don't have our hands on the actual [stolen] data, but we can tell a lot of what they [may be] doing with it by the malware," Shalltin says. "They can use it for spam, [stealing data], and almost almost anything."
Around 45 percent of the bots are in the U.S., and the machines are Windows XP. Nearly 80 percent run Internet Explorer; 15 percent, Firefox; 3 percent, Opera; and 1 percent Safari. Finjan says the bots were found in banks and large corporations, as well as consumer machines.
Shalltin says it appears that the botnet operators may be buying and selling bots or portions of their botnet based on a communique Finjan discovered on an underground black-hat hacker forum in Russia.
Subscribe to:
Posts (Atom)
