[iwar] [fc:NIPC.ALERT.02-001:."Potential.for.Multi-Sector.Internet.Outages"]

From: Fred Cohen (fc@all.net)
Date: 2002-02-14 22:05:13

Next message: Fred Cohen: "[iwar] [fc:Big.Brother.is.watching.you.read]"
Previous message: Fred Cohen: "[iwar] [fc:Information.Operations.in.the.Army.Reserve]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Message-Id: <200202150605.g1F65Do08602@red.all.net>
To: iwar@onelist.com (Information Warfare Mailing List)
Organization: I'm not allowed to say
From: Fred Cohen <fc@all.net>
Mailing-List: list iwar@yahoogroups.com; contact iwar-owner@yahoogroups.com
Precedence: bulk
Date: Thu, 14 Feb 2002 22:05:13 -0800 (PST)
Subject: [iwar] [fc:NIPC.ALERT.02-001:."Potential.for.Multi-Sector.Internet.Outages"]
Reply-To: iwar@yahoogroups.com
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

NIPC ALERT 02-001: "Potential for Multi-Sector Internet Outages"

NIPC, 2/12/02
<a href="http://www.nipc.gov/warnings/alerts/2002/02-001.htm">http://www.nipc.gov/warnings/alerts/2002/02-001.htm>

The National Infrastructure Protection Center is aware of potential
vulnerabilities existing within the Simple Network Management Protocol
(SNMP) -- a protocol used by routers, switches and hubs on the Internet
and other related equipment. To date, there have been no confirmed
exploitations of these vulnerabilities. However, action may be required
to prevent the possibility of criminal exploitation by malicious
hackers. NIPC has been monitoring the vulnerabilities and is working to
address the issue and minimize potential disruption.

Due to the widespread use of the SNMP, the number of affected products
is extensive. NIPC, along with Carnegie Mellon University's Computer
Emergency Response Team/Coordination Center (CERT/CC), is working with
other government agencies, network security experts, and industry
representatives to define, prioritize, and mitigate these
vulnerabilities. In the absence of a specific SNMPv1 vulnerability and
patch, the following list of "best practices" has been suggested by
CERT/CC:

1. Review what versions of SNMP are running; apply vendor patches as
available.

2. Disable SNMP service if not critical.

3. Block access to SNMP services at network perimeter.

4. Filter SNMP traffic from non-authorized internal hosts.

5. Change default community strings.

6. Segregate SNMP traffic onto a separate management network.

7. Apply egress filtering on ports 161 and 162.

8. Disable stack execution where possible.

For additional information on preventing the exploitation of computer
systems, visit the CERT/CC homepage at http://www.cert.org.

Actual or attempted hacking is a serious federal offense that could land
first time offenders in jail for ten years and repeat offenders in jail
for 20 years. The NIPC encourages the reporting of computer intrusions
to local FBI offices or the NIPC Watch and Warning Unit at (202)
323-3205 or 1(888) 585-9078. You can also e-mail NIPC at
nipc.watch@fbi.gov. In addition, incidents can be reported online at
<a href="http://www.nipc.gov/incident/cirr.htm">http://www.nipc.gov/incident/cirr.htm>.

------------------
http://all.net/ 

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/

Next message: Fred Cohen: "[iwar] [fc:Big.Brother.is.watching.you.read]"
Previous message: Fred Cohen: "[iwar] [fc:Information.Operations.in.the.Army.Reserve]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

This archive was generated by hypermail 2.1.2 : 2002-12-31 02:15:03 PST