Security experts and overworked systems administrators for years have implored users to pick hard-to-guess passwords and to change them often. But many users persist in using their names or children’s birthdays as log-on credentials, and two recent worm outbreaks have shown why that’s such a risky practice. Deloder, the latest worm to hit vulnerable Windows machines, as well as a recent version of Lovgate, both use a list of common passwords in an attempt to compromise computers. Lovgate began spreading late last month, while Deloder appeared last week. Although neither worm has spread as far or as fast as threats such as SQL Slammer or Code Red, both Deloder and Lovgate clearly illustrate the danger inherent in lax security policies. In Deloder’s case, the worm tries to connect to random Windows NT, Windows 2000 and Windows XP machines on TCP port 445, normally used by Microsoft Corp.’s Active Directory. It then looks for network shares on the remote machine and, if it finds any, tries to copy itself to the shares by using easily guessed passwords to gain access. The worm also installs a Trojan horse and a utility for executing commands on remote machines. Full Story
About OODA Analyst
OODA is comprised of a unique team of international experts capable of providing advanced intelligence and analysis, strategy and planning support, risk and threat management, training, decision support, crisis response, and security services to global corporations and governments.