Rinbot.BC Worm Exploits Un-Patched Microsoft DNS Vulnerability

I heard about this vulnerability recently, and according to search security, there is now a worm, Rinbot.BC, using the exploit. I haven't heard any reports yet on how widespread the worm is, but it is probably a good idea to use the workaround mentioned in Microsoft Security Bulletin 935964.

The vulnerability was announced last week, and there is talk that Microsoft is going to issue a out of cycle patch to fix the issue. Windows Server 2000 SP4, and Windows Server 2003 SP1 and SP2 are effected. Of course clients don't run a DNS server, so Vista, XP and 2000 are not affected.

The security bulletin lists several ways to work around the vulnerability, I thought the easiest way was to use the method that uses the registry to disable remote management of the DNS server through RPC. Terminal services (including remote desktop), and the local machine will still be able to manage DNS settings.

5 Reasons to leave your Wireless Devices turned off at the RSA conference

This is all from the article "RSA: Attendees drop ball on Wi-Fi security" over at ComputerWorld. The wireless security vendor AirDefense Inc was monitoring the Wireless networks during the conference. Here are some of their findings, and the reasons I would have my wireless turned off if I were at the RSA conference.

1. 30 Devices pretending to be access points.
Not only were they pretending to be access points, but they were pretending to be access points from the conference network. One of them even had a self-sign certificate made to look like the conference authentication server. Others were configured to look like T-Mobile and IBAHN access points, as well as the access points of local hotels.

2. I like my service, so please don't Deny it.
There were 57 Denial of Service attacks on the first day of the conference, including jamming and de-authenticating clients. What fun.

3. Lots of Scanning
NetStumbler and similar programs were scanning for access points regularly. The article says that it was by attendees, but who can really be sure.

4. I don't want anyone else controlling my computer.
On the second day of the conference, one attacker had taken over 8 machines, and was using them to launch attacks on other machines.

5. I should be the only one who knows my password
A whole bunch of the clients connecting to the bogus access points were advertising domain information, including authentication server, user name, computer name, as well as sending out the authentication hashes which contained username and password.

Making it a little easier for the bad guys
AirDefense Inc, also found that more than half of the wireless devices in use at the RSA conference were not secure. Remember, the RSA is the security division of EMC, and the attendees are the people responsible for their company's computer security.

This would be like finding out Bill Gates uses Linux, that Steve Jobs has a Windows Logo tattooed on his rear, or going to a hair stylist who has a mullet.

Some other things they found were unsecured wireless access points with two notorious names, one named "Free Internet Access" and one called "Linksys". Not only were these access points out there, but 70 devices connected to them on the first day, and 87 on the second day!

There were obviously other "security experts" in attendance
Obviously there were hackers there, trying to mess around with the experts. I think that I will make sure to turn my wireless off anytime I go to a big conference like this one. I remember reading something about all the stuff going on at the last DEF CON.

I wonder if anyone was checking this at CES. I know there were a whole slew of people blogging from there.

Winamp Site Hacked?

Strange thing today, I tried to download Winamp, and as soon as you make all of your selections, and click download, instead of a download screen, you get this:


I thought at first that this might be displayed while I am waiting for the download to start. The URL listed was:
http://download.nullsoft.com/

It gets a little bit stranger, I pinged download.nullsoft.com, and it is resolving to 172.30.74.154, which is in a reserved address range. A ping from www.network-tools.com resolves it to 172.20.149.50.

If you do a whois on nullsoft, the ip address is 205.188.234.120

I wonder if this has anything to do with the DNS Root Server attack yesterday.

Update 11:30: Winamp fixed the problem. The site is now resolving to 149.174.36.119 and the page is a directory listing of the site. Downloads work fine now. I'll be curious if they ever say what happened.

Creating A Certificate For Outlook Web Access 2003 Using SelfSSL

If you haven't run across msexchange.org yet, you really should give it a look. A huge amount of good articles, as well as discussion board.

I was browsing around on the site, and I ran across this neat article about how to Create a Certificate for Outlook Web Access 2003 Using SelfSSL. I know I am not really keen on buying a certificate for my company from VeriSign, and this seemed like a cost effective way to get some good security for employees using Outlook web access.