After a weekend of monitoring here’s what we seem to know about the MS06-040 Worm(s) in the wild:

• There’s at least two variants in the wild so far (ref)
• It appears to be primarily targeting Windows 2000 machines (ref)
• After infecting machines it communicates out via IRC via port 18067 and scans for additional machines to infect via port 445 (ref)
• One variant is also spreading via AOL IM. (ref)
• Most AV Vendors have released updates to detect for at least some of these known exploits.
• The purpose of the worm seems to be to spread a botnet to SPAM.

A couple of stats to ponder:

• Time from patch release to public POC code: ~40 hours
• Time from patch release to self propagating worm: ~96 hours
• Average time it takes an enterprise to patch a critical vulnerability: A lot more than 96 hours.

References:

• Microsoft Security Response Center Blog
• SANS ISC
• LURHQ
• Security Fix

Post a Comment...