Open SSL exploit on apache. Worm spreading

[jkrohn]

http://apache.slashdot.org/apache/02....shtml?tid=172

Affects any Linux apache running OpenSSL <0.9.6g

Jkrohn

[MegalosSkylaki]

Grew from 2,000 Servers to 6,700 in same day (Friday).

Symantic states it can ID the IP of WORM if the Sites are placed on-line, because it actively tries to communivcate with other Servers.

Four methods of attack:deluge of data;forcing commands to be executed;redirect requests;send back info like e-mail addy's.

Uses OpenSSL. Apache accounts for about 2/3 of Sites on I-Net.

http://news.com.com/2100-1001-958122.html?tag=fd_top

DOOOOG

[vass0922]

OpenSSL bug was the reason MS had to update IE, and Opera released Opera 6.05 ... hit pretty much every product out there that uses Open SSL

[crouse]

http://online.securityfocus.com/advisories/4311

has been known for awhile......... only unpatched systems will be affected. Same as with any server OS . But I'm betting the worm won't come close to some of the MS worms .......... still........ wouldn't a internet lacking worms/virus's/spammers be great ??

[MegalosSkylaki]

There might be a lot less of it.

The Gov't doesn't have the Tech people or the political will to stop it. The laws are written by people who don't understand it.

Private industry can out-bid the Gov't for security experts.

Most are treated as nuisances.

But anything that changed the way you have to live your life--and computers are a big part of many peoples lives--is more than a nuisance.

It is a theft of quality of life; and a "cost item" that has to absorbed by the economy at large. Sort of like a "tax" on gas or electricity. A tax on computer use.

When was the last time you heard of some virus-spreader indicted and doing time. First conviction should carry a sentence. And a class-action civil suit.The law is behind the times and the Gov't has to pay market price for the Tech experts.

DOOOOOOOG

Hmmmmm..this deserves a Post of its own.