CyberSecurity Institute

In Windows 2000, Windows XP and Windows Server 2003, Microsoft uses TCP Port 445 to run SMB directly over TCP/IP to handle the sharing of files, printers, serial ports, and also to communicate between computers.

She said software engineers at Redmond would continue to analyze and monitor for any malicious activity but stressed that she was not aware of any customers being attacked via sniffing against TCP Port 445 and have not received any indication of malicious activity associated with MS05-027.

John Pescatore, VP of security research at Gartner Inc., said the reports of increased sniffing on Port 445 are a “serious concern for enterprise security managers” because such activity usually means a mass attack is imminent.

“[Administrators must] immediately review all firewall policies (including those covering personal firewall software) to ensure that Port 445 access is blocked wherever possible [and] update all intrusion prevention system filters (both network- and host-based) to block attempts to exploit this vulnerability,” Pescatore added.

http://www.eweek.com/article2/0,1759,1830698,00.asp?kc=EWRSS03119TX1K0000594

This week, security company Symantec sorted through low-volume e-mail threats submitted to its response team for analysis and found several that had targeted U.S. government agencies or had been submitted to Symantec from government sources in the United States. Two programs that fit the profile–identified by Symantec as Trojan.Mdropper.B and Trojan.Riler.C–were among the threats warned about by the NISCC.

Last month, law enforcement agencies in Israel found that private detectives had allegedly used targeted Trojan-horse programs to steal information from their clients’ competitors, according to press reports.

The latest attacks are targeted at only a few companies or government agencies at a time and show signs of significant background research into the target, said Mark Sunner, chief technology officer for e-mail security firm MessageLabs.

While data on the attacks is scarce, with the company only detecting two attacks per week, they are a serious threat, he said.

The United States Computer Emergency Readiness Team, or US-CERT, has not released a statement on the NISCC advisory.

The stealthy attacks have frequently been sent to a specific person at the targeted organization and show that attackers are researching the best way to convince the victim that the document containing the Trojan horse is real. Moreover, tradition e-mail-borne mass-mailing viruses typically have not stolen documents. Both MyFip and the latest string of attacks discovered by MessageLabs and NISCC appear to come from China.

http://www.securityfocus.com/news/11222