|
Sasser
(worm) and FireWalls:
Today, it's just too easy to fall prey to
modern Internet viruses,
especially so-called "blended threats" like the recent Sasser worm and
its variants, which exploited a Windows 2000/XP operating system
vulnerability to drop Trojan-like payloads on infected PCs with
astonishing ease.
Unlike
the recent wave of mass-mailing worms
(Mydoom,
Bagle and Netsky), Sasser slipped past regular security defenses
without hiding inside a typical email attachment. Simply by logging
onto the Internet, vulnerable systems contracted the worm, which
wrecked worldwide havoc by shutting down PCs and networks.
Technically,
on infected PCs, Sasser creates a
remote
TCIP shell at communication port 9995, scans the Internet for
vulnerable computers, then forwards copies of itself. Infected systems
pass Sasser on with exponential force. Imagine a pebble tossed into a
still pool, spreading replicating waves of concentric (and infectious)
ripples, looking for new targets.
Last
month, authorities caught the Sasser worm
programmer, a German teenager who, ironically, claimed his original
goal was to create a virus called "Netsky A" that would combat the
recent "Mydoom" and "Bagle" viruses, helping remove them from infected
PCs. In the process, he birthed Sasser.
How
many PCs fell victim? No one knows for sure.
Estimates ranged from "several hundred thousand" to "millions" of PCs
worldwide.
"Still,
for all the trouble Sasser caused, it
didn't
compare to last summer's Lovsan," said James Schmidt, McAfee
Personal
Firewall Plus product manager. Like Sasser, that worm also
exploited a Windows OS flaw. "Incredibly, after just 24 hours,
Hackerwatch.org recorded 78 million Lovsan-related pings on IP
addresses, 2 billion after 30 days. Sasser never approached that
volume."
How
to Protect Your PC From Sasser-like
Threats
- Install
and
update your anti-virus protection.
- Download
the
latest Microsoft Windows operating
system patch. On your Internet Explorer toolbar, go to Tools, select
Windows Update then "Scan for updates." In the meantime, read
Microsoft's own security
bulletins.
- Complement your anti-virus
protection with the
multi-layered protection provided by a firewall. For example, McAfee
Personal
Firewall Plus
puts a secure barrier between your PC and
unauthorized communication, helping block Sasser-like worms before they
can attack or infect your PC, which in effect, remains invisible to
such threats.
Essential Protection for Network
Connections
Ideal
for dial-up or broadband (DSL, cable)
Internet
connections, McAfee
Personal
Firewall Plus not only blocks online thieves but lets you
trace the
source of hacker attacks, avoid future threats and alert the proper
authorities (including ISPs or law enforcement). And because ease of
use remains a concern with this technology, McAfee
Personal
Firewall Plus is designed for maximum protection the moment
it is
installed so that users can "install it and forget it."
In
fact, industry analysts such as those with
highly
respected research firm Gartner Inc. strongly recommend that companies
use personal firewalls on as many PCs as possible. The need is greatest
for enterprise laptops and all machines used by remote workers with
broadband connections.
There
are several common sense reasons for this.
First,
there's the sheer number of potential threats. Researchers estimate
there might be up to 100,000 known viruses, with literally hundreds of
new ones being created or unleashed every month. And often, the
vulnerabilities they exploit weren't introduced by the user; they were
in the operating system to begin with, and require a high level of
technical sophistication to even detect, let alone remedy.
"Viruses
that exploit vulnerabilities in an
operating
system are much more serious-they have the potential to bring down a
company's entire local area network," Schmidt added. "That's why, in
this time of heightened security, every PC that's part of a corporate
network needs to have a personal firewall."
Save $5 on McAfee Personal Firewall Plus
Article Compliments of McAfee
VirusScan
Website Try McAfee FireWall
|
