Sasser Worm Spreading Through LSASS Exploit

The Sasser worm began spreading among unpatched Windows computers today, exploiting a known security hole in LSASS. While Sasser uses similar mechanics as earlier mega-worms Slammer and Code Red, Sasser thus far doesn't appear to be the dramatic event anticipated by worm-wary security firms.

F-Secure reports that the new worm attacks through TCP port 445 (Windows networking), spreads itself through an FTP server on port 5554, and leaves port 9996 open for future exploits. Sasser has received a level 3 rating from Symantec, the middle of its five-point alert scale. Secunia also perceives Sasser as a medium threat, and The Internet Storm Center moved to yellow alert condition, but cautioned that "the exact impact is not clear at this point."

Continue reading