[ news_security_news ]
Product Detects Worm Outbreaks Before AV Vendors
SecurityProNews
Staff Writer
2004-11-01
 Insider Reports RSS Feed
ForeScout Technologies announced today that its product, WormScout, stopped a zero-day worm, W32.Gaobot.BOW (Gaobot), from spreading within a major enterprise customer's network hours before a signature was available.
Gaobot is a very intelligent worm whose first activity is to shut off any AV (anti-virus) software and then it prevents connectivity to AV vendors such Symantec, TrendMicro, Norton as well as to Microsoft updates. The worm proceeds to open up random TCP ports allowing the network to be controlled from a master machine.
The worm was detected and stopped during a global installation of WormScout at a Fortune 1000 customer. A contractor, who was unaware that his machine was contaminated, unleashed the worm when he connected into the network inside the perimeter. This particular network has a phalanx of security tools including updated host-based anti-virus software, an intrusion detection system and a firewall, all of which failed to detect and/or stop the infection. WormScout had just been installed in this segment of the network and it was only set in the monitor mode. As soon as the worm was detected, WormScout was turned on in automatic blocking mode and it immediately began to contain the rapidly spreading Gaobot worm and there was no impact to business continuity. If WormScout had not detected this malware, the entire network's assets would have been exposed to the master computer, which is believed to be located in Russia.
"This is a real-world example of the conclusions reached by the tests we ran in our independent lab," said Kevin Cooke, director of Independent Testing Services Powered by Network Computing Labs. "WormScout was able to not only contain the activities of an ultra-aggressive and intelligent worm of our own creation, but did so while protecting the vast majority of host systems in our test environment."
"This scenario is a text-book illustration of the value proposition of our WormScout product," said Kenny Frerichs, president of ForeScout. "Network worm outbreaks are unpredictable and the consequences are devastating. The internal network is particularly vulnerable because remote users and contractors access the network through VPNs (Virtual Private Networks). A company cannot depend on a signature-based solution because signatures are issued too late to protect against a zero-day worm. Based on our patented technology, WormScout accurately detects and stops zero-day worms providing instantaneous and automatic protection allowing a company to maintain business continuity during worm outbreaks. This is why 100% of our customers turn on automatic blocking."
About the Author:
SecurityProNews is a daily online and email publication focusing on internet security issues.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
