Stopping Worms And Trojans; Example: Sql Worm - Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1 Administration Manual

Stopping Worms and Trojans

Copyright © 2010, Juniper Networks, Inc.
Apache (two versions)
Microsoft IIS, version 6.0
Select the Microsoft IIS 6.0 value to find out which IP addresses are running the IIS
3.
server. The Protocol Profiler displays the destination IP address of the service, which
is the IIS server.
Patch the vulnerable IIS server by using the information supplied with the Microsoft
4.
Security Bulletin.
Worms and trojans often bypass firewalls and other traditional security measures to
enter a network. Because worms and trojans operate inside a network, external firewalls
might not be able to detect them.
Use the Profiler to determine when a worm or trojan entered your network, how it was
introduced, and which network components were infected. By filtering the profile data
you can identify the source and contain the attack to minimize impact, before investigating
and recovering from any damage.

Example: SQL Worm

For example, your corporate security policy does not permit SQL servers on the internal
network. However, during a regular Microsoft update, SQL applications are installed on
a network server, without your knowledge. Because you are not aware that an SQL server
is running on your network, you do not attempt to block SQL attacks at your firewall or
IDP system. Suddenly, the SQL Slammer worm attacks and infects your network.
Using the Profiler:
Create a custom TCP service object to represent Microsoft SQL (default port:
1.
TCP/1433).
Restart the Profiler.
2.
Select the Network Profiler to quickly see the source, destination, and service of traffic
3.
on your network.
In the Service data table, select the SQL service you just created. The Network data
4.
viewer lists all network components current running SQL servers.
Take appropriate measures to secure the network, such as:
5.
Apply patches.
Remove the components from your network.
Remove SQL from all components.
Create a rule in your security policy that drops all SQL connections between your
internal network objects.
Chapter 18: Analyzing Your Network
729