Continued from page 1
After rebooting
system in safe mode and reviewing event logs, I found cause of problem. The event log revealed that TCP/IP stack repeatedly exceeded maxim number of connections. I had fell victim to a local machine Denial Of Service attack.
In most cases, an event like this would reveal at least something out of ordinary; A registry entry, file, or service that should not be present. But not in this case.
The computers local drives were imaged to preserve their current state. The images were then submitted to our Anti-Virus and Firewall vendor research teams. As of today, they have not been able to determine exact cause of problem. They do know something malicious is going on, and are looking closely at TCP/IP stack and system process. Short-term investigation points in direction of one of these components being modified or corrupted. It's quite possible that a new vulnerability exists and I'm fairly confident they will be able to pinpoint it.
What's The Point
----------------
I've seen just about every type of exploit, vulnerability, and e-mail attack you can think of over years. Some items we uncover during security assessments would make your jaw drop.
It never ceases to amaze me how many people out there just don't care what kind of problems or damage they cause. It appears as if point of this recent e-mail attack was nothing more than to cause recipient grief, to put target computer out of business for a while. One things for sure, it resulted in a bad day for me. The time I had to put into investigating situation, and preparing images for delivery to our vendor, could have been spent working on something productive.
Conclusion
----------
Because of this event, we have configured a dedicated system who's sole purpose in life is to test potentially harmful url's. It is actually a virtual machine that if attacked, can be configured to its default state within seconds.
I can only imagine stress and frustration others without technical experience or resources must go through when something like this happens. I receive countless e-mails from our site visitors regarding their concern that they may have been attacked or compromised. I wish I could help them all out directly but that is not always a reality.
What I can do is share my experiences and recommendations. This is one of primary reasons why I enjoy writing articles as much as a do.
Darren Miller is an Information Security Consultant with over sixteen years experience. He has written many technology & security articles, some of which have been published in nationally circulated magazines & periodicals. Darren is a staff writer for www.defendingthenet.com and several other e-zines.
