|8/1/03 4:00:00 PM ET
Internet threat looms as thousands of hackers meet
By Elinor Mills Abreu
|Mortgage Services from Homebound Mortgage
LAS VEGAS, Aug 2 (Reuters) - Network experts, government
agents and young would-be hackers debated real and theoretical
threats to computer security on Saturday at the year's biggest
Internet defense conference, even as the latest Microsoft
software bug left computer networks open to widespread attack.
Day two of the three-day DefCon conference drew 5,000 geeks
to the outskirts of America's gambling capital, where they
heard security professionals detail the newest vulnerabilities
of everything from phones to satellites to refrigerators.
But in a 24-hour party atmosphere where the legal and
illicit mingle, the agenda of technical lectures and
tip-sharing was overshadowed by the challenge disrupting
Internet users in the real world beyond Las Vegas.
"Once a year, or every other year -- not often -- you see
this type of widespread vulnerability with so many systems
affected," said Marcus Sachs, director of the National Cyber
Security Division of U.S. Department of Homeland Security.
Sachs and other attendees said the latest Microsoft
security hole affects several types of Microsoft Corp.
(nasdaq: MSFT - news - people)
Windows software that are widely used in business.
"In theory, you have all the makings of a worm," or a virus
that can spread itself to other machines, Sachs said.
The so-called Remote Procedure Call vulnerability can allow
a rogue computer user to remotely take over a machine or
network of machines and put the computers out of service.
A government advisory warning of the latest vulnerability
issued more than a week ago was updated on Thursday after
nefarious programs designed to take advantage of the Microsoft
software weakness began to spread on the Internet, Sachs said.
SCANNING FOR VULNERABLE COMPUTERS
According to the SANS Institute, at least 2,000 machines
were scanning the Internet looking for vulnerable computers,
from which further attacks could be staged.
"It's definitely one of the worst (security) problems to
happen in the last few years because it is so widespread," said
Chris Wysopal, a member of security consulting firm AtStake.
"This could easily be turned into a worm like Slammer or
Code Red," he said, referring to the nicknames for attacks in
recent years that have hit millions of Internet users.
Microsoft has made available a software security patch at
http://microsoft.com/technet/ and is encouraging network
administrators to apply it to private networks.
Also, a new worm was circulating in e-mail in-boxes that
purports to be from a system administrator, said Sachs. Network
Associates rated the worm, dubbed "Mimail," a medium risk.
At the show, hackers entertained themselves in contests
designed to show off their computer cracking skills and
abilities at spotting undercover police agents, while others
lounged by the pool sharing tips on computer attacks.
Now in it's 11th year, overt illegality has toned down
since DefCon organizer Jeff Moss urged attendees to turn to
more productive activities in the wake of the Sept. 11, 2001,
attacks on U.S. cities.
Conference sessions were devoted to security of hand-held
devices, maintaining privacy on the Internet and things like
"mimicry," in which attendees learned how to avoid surveillance
by hiding encrypted computer code amid innocent-looking text or
Another talk discussed the threat to newly emerging home
automation systems in which everything from lights to coffee
pots to refrigerators and sprinkler systems are hooked up to
computer networks, making them potential targets of attack,
according to Roberto Preatoni, founder of Zone H, an Estonian
firm that records hacking attacks.
Copyright 2003, Reuters News Service