MS06-040 update
MS06-040 is one of last weeks Windows updates and is the one that was probably the biggest target for “wormable” activity. There’s a good deal of news from over the weekend with regards to this. First: Snort signatures, the MS06-040 exploit was spotted actively “in the wild”, and of course, our perennial friends in the spamming world didn’t waste much time in making use of this one.
The quick turnaround now from vulnerability announcement to the exploit code being rolled up in a usable form REALLY emphasizes how important it is to keep your pc updated. We are in a war – it’s going on all the time and most people don’t notice it (to paraphrase from the recent Dr. Who revival)…. there are a lot of people out there that control a LOT of pc’s. The owners of the pc’s don’t realize it – they think they’ve just got annoying popups, but their computer ceased to be theirs a long time ago and the botnet controllers are eager to keep adding to the size of their army’s.
Why? rent them by the thousands to junk mailers, click fraudsters, illegal content hosting (child pornography/phishing/use your imagination/etc/etc/etc). They can be used to bring a web server to it’s knees silencing companies, or even government sites. They can be used for blackmail. There are a lot of possibilities. The bottom line is there are tens of thousands – possibly hundreds of thousands if not millions of computers out there on the internet owned by botnet herders and they’re always eager to find a way to add to the flock. Every patch day there are possibilities, some of them aren’t too promising, but sometimes there are a few vulnerabilities that are just right and can get rolled into arsenal to “recruit a few more bots.”
It’s interesting to note that in Brian Krebs update to his post on this, there are a number of interesting points – one is that the most recent Microsoft One Care antivirus update that was available for virustotal was almost 10 days old (8/04/06). I wonder if they’ll move towards once a month AV signature updates?….