Michael Posted June 5, 2012 Posted June 5, 2012 Hello all, Thought I'd make you all aware of a new malware called 'Flame', here are some details. It looks particularly nasty as it creates unauthorised certificates as if they came from Microsoft themselves. That's only going to cause trouble! This affects Windows XP/2003/Vista/2008/7/2008 R2, both x86 and x64. I suspect Windows 8 and Server 2012 will include the patch by default. 2
Netwacky87 Posted June 5, 2012 Posted June 5, 2012 (edited) Yeah, saw this on the BBC website the other day...info here: BBC News - Flame: Attackers 'sought confidential Iran data' Apparently its been around for years, in some form or another....:/ Edited June 5, 2012 by Netwacky87
Michael Posted June 5, 2012 Author Posted June 5, 2012 On a related issue, if you've setup WSUS as per my recommendations here, you'll find your servers should already be patched! 2008 R2 installs the update without needing a restart. 2003 does need a restart to complete the update.
Arthur Posted June 5, 2012 Posted June 5, 2012 Already posted in the Security forum... www.edugeek.net/forums/security/95903-flame-massive-cyber-attack-discovered.html
zlorimer Posted June 11, 2012 Posted June 11, 2012 (edited) These updates broke my WSUS and I cannot get anything to work again. I guess I will be rebuilding the server... Edited June 11, 2012 by zlorimer
Arthur Posted June 11, 2012 Posted June 11, 2012 These updates broke my WSUS Could it be proxy related? The company's Windows Server Update Services, which businesses and organizations use to deliver patches to large fleets of PCs, will no longer work through network proxies that use deep packet content inspection, Microsoft representatives said in an advisory published Friday afternoon. Such proxies act as man-in-the-middle devices that can peek inside encrypted traffic as it travels from a local network onto the Internet. Enterprises that have inspection servers in place will have to create exception rules so all Windows Update traffic is bypassed.
zlorimer Posted June 11, 2012 Posted June 11, 2012 (edited) Nah. We don't use proxies here. I cannot open the MMC using the Internal MS DB setup on WSUS3.0 SP2. I am thinking I am going to have to rebuild it because I cannot find any real answers or anything. Edited June 11, 2012 by zlorimer
Michael Posted June 12, 2012 Author Posted June 12, 2012 I've not had any problems applying the update to WSUS 3.0 SP2 on both 2003 and 2008 R2 servers. I'd try repairing the product and this should resolve it.
Michael Posted June 12, 2012 Author Posted June 12, 2012 And I just remembered, today is Patch Tuesday with 7 updates being released later today!
X-13 Posted June 12, 2012 Posted June 12, 2012 (edited) If this is the "Flame" I'm thinking of... It's a Stuxnet variant. That is to say, it's the same level of shenanigans and subterfuge... by the same people. Also: Stuxnet/Flame comparison Edited June 12, 2012 by X-13
Oaktech Posted June 12, 2012 Posted June 12, 2012 see here... http://www.crysys.hu/skywiper/skywiper.pdf it's a very interesting in depth article containing a comparison of flame/skywiper and stuxnet, they are not the same at all, or even derived from each other. They contain some similar components and modes of operation but are very different beasts.
X-13 Posted June 12, 2012 Posted June 12, 2012 see here... http://www.crysys.hu/skywiper/skywiper.pdf it's a very interesting in depth article containing a comparison of flame/skywiper and stuxnet, they are not the same at all, or even derived from each other. They contain some similar components and modes of operation but are very different beasts. From what I've heard, and I may have misread, it's looking likely that it was made by the US/Iranian government... Like Stuxnet. This is what I was saying. If true, it looks like it's more cloak+dagger cyber shenanigans... and not really anything the average end-user needs to worrk about.
Oaktech Posted June 12, 2012 Posted June 12, 2012 From what I've heard, and I may have misread, it's looking likely that it was made by the US/Iranian government... Like Stuxnet. This is what I was saying. If true, it looks like it's more cloak+dagger cyber shenanigans... and not really anything the average end-user needs to worrk about. Right ho... The finger has been pointed at the US and or israel for stuxnet, flame is significantly different in style, probably not the same group of coders, but a broadly similar idea. No one is really able to point the finger for flame yet. Obviously it's not a great idea to have backdoor access software floating around on ones pc/network, but i agree that it is probably of very little concern for most people... it's got bigger fish to fry!
zlorimer Posted June 12, 2012 Posted June 12, 2012 I've not had any problems applying the update to WSUS 3.0 SP2 on both 2003 and 2008 R2 servers. I'd try repairing the product and this should resolve it. It seems to be a common problem I will post up if I can find a fix, but just a forewarning to everyone, be careful. WSUS 3.0 SP2 will not run after installing update 2720211
Michael Posted June 12, 2012 Author Posted June 12, 2012 It seems to be a common problem I will post up if I can find a fix, but just a forewarning to everyone, be careful. WSUS 3.0 SP2 will not run after installing update 2720211 Looking at that, I wonder if the common factor are admins using SQL 2008 instead of the Windows Internal Database (WID). I use WID in all instances.
zlorimer Posted June 12, 2012 Posted June 12, 2012 (edited) I use WID as well for WSUS. I only use one server in WSUS, but I am getting ASP.NET 2.0.x.x errors in addition to the WID errors. But yeah, I'm basically dead in the water currently since I cannot do anything and no one in my network is receiving updates now. Thankfully, summer just started so I have some time to be patient. Edited June 12, 2012 by zlorimer
zlorimer Posted June 13, 2012 Posted June 13, 2012 Well if anyone comes across the same problem that I did, I fixed it. I had to uninstall everything involving WSUS and reinstall everything. It wasn't bad, but it took some time.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now