Sasser worm exposes patching failures

Organizations that evaded last week’s Sasser worm infestation credited vigilant patching processes and preventative measures such as installing server-based behavior-blocking software and worm filtering gateways.

Organizations that evaded last week’s Sasser worm infestation credited vigilant patching processes and preventative measures such as installing server-based behavior-blocking software and worm filtering gateways.

Anti-virus software, on the other hand, was of limited use in stopping the four known variants of Sasser because the worm could re-infect machines even with the most up-to-date virus signatures, says Vincent Gullotto, vice president at Network Associates’ Avert Labs. “If you don’t have the [Windows] patch in place, this can happen,” he says.

According to Mikko Hypponen, head of anti-virus research at F-Secure in Helsinki, Finland, the Sasser worm variants don’t delete files or leave Trojans. This makes it a fairly benign worm and a lot like the Blaster worm of last August. Like Blaster, damage stems from Sasser’s intense network scanning, which can paralyze networks.

Among those experiencing Sasser’s sting last week were American Express, Goldman Sachs, Air Canada, British Airways, Germany’s Deutsche Post, the European Commission and several schools, including the University of California, Irvine and University of Massachusetts at Amherst.

“It affected some of our support systems and caused a degree of disruption internally,” says Lucas Banpraag, a Goldman Sachs spokesman. “It delayed processing of some orders.”

The Sasser worm infested the financial firm’s network a week after hitting its offices in Asia. Goldman Sachs is reviewing how it prioritizes patch management and wants better guidance from Microsoft, the spokesman says.

Microsoft had made the patch available more than two weeks ago for the so-called Local Security Authority Subsystem Service (LSASS) vulnerability that Sasser exploits, giving it a critical rating.

But the sheer size of some organizations makes it hard for them to patch all systems, says Alfred Huger, senior director of engineering for security response at Symantec.

Wolters Kluwer, an 18,500-employee firm in Amsterdam that provides legal information services, got hit with Sasser.

“It was only half a dozen PCs out of hundreds,” says Mike Antico, CTO for the firm’s North American divisions. “How did these people escape being patched? We think it’s because they bring in portable computers.”

Many corporations test patches before applying them to machines, particularly critical servers, so the larger the organization, the harder it is to go through this process before a worm appears to take advantage of a newly identified hole.

Companies say they are turning to other defensive measures above and beyond simply patching. One of these is behavior-based software that blocks worms and other types of attacks by recognizing suspicious activity.

“Our Windows environment was patched within three days of the released [LSASS] patch, except for one server where a critical system needed to be regression-tested longer,” says Eben Barry, manager of IT operations at Network Health, a Medicaid insurance provider in Cambridge, Mass. Luckily, this time the delay did not result in an infection.

The organization has deployed Sana Security’s Primary response software on its patched and unpatched servers, and configured it in advance to minimize potential Sasser worm exploits.

Other firms say worm-blocking barriers at the Internet gateway stopped Sasser’s flood from striking them.

Andre Foster, vice president of IT at Cable Bahamas in Nassau, says he set up TippingPoint Technologies’ UnityOne appliance to filter out Sasser after seeing Blaster sap the service provider’s network capacity last year.

Mark Georgis, network administrator at Long Beach Transit in California, says he used Fortinet’s FortiGate appliance to block Sasser coming in from the Internet and monitored for any worm outbreaks on the inside with Network Instruments’ Observer tool. But luck was on his side, too, as Georgis acknowledges all the organization’s patching wasn’t up to date.

“I was scared to death,” he says. The Sasser scare now has him setting up his LANDesk systems management tool to automate patch updates to desktops the minute they’re available.