Active Countermeasures

Escalating Threats from Bots, Worms & Automated Large-Scale Intrusions

Modern worms are tools of organized crime. They are used as engines of large scale identity theft, fraud, unsolicited email advertising, espionage (both industrial and state-sponsored). Worms and botnets sport many nefarious capabilities. They can:

• scan networks for host information and vulnerabilities and upload results to remote servers
• log keystrokes looking for credit card and bank account information, username and passwords to systems and other data
• scan filesystems looking for documents and data
• upload data and files to remote locations
• download and install other software, update the worm
• install rootkits so that the worm activity is hidden
• open additional back doors into a system
• read email address books and upload contact information to remote servers
• send copies of the worm via email
• send SPAM from the infected host
• execute arbitrary commands issued by remote attackers

Modern worms give a remote attacker complete control over the infected system exactly as if they had telnet or ssh access directly to the system.

Realtime Intrusion Suppression

Recent headlines indicate that the threat from network intrusions is greater than many organizations have assumed.

45 million credit card numbers stolen from a major retail organization over a period of two years, a record theft and an event which reveals that even large, well-funded IT shops can be infected without knowing it a major media outlet hit by a worm botnet-infected systems spamming from the networks of Fortune 500 companies.

Realtime Intrusion Suppression can help prevent problems like these, reducing the risk and costs faced by network operations.