The start of a new attack

I just spent the whole morning watching my intrusion detection alerts and tracking the progress of Nimda ('admin' spelt backwards). If you haven't been tracking the security lists, and I am sure most admins in Malaysia are not, then here's a heads up. Nimda is a new worm/virus which has currently 4 known attack vectors. It spreads by using the same IIS vulnerability which Code Red made use of, it spreads by email and it spreads when an Internet Explorer browser stops by an infected webserver. This means that anyone sitting on a Windoze box using Outlook and IE are vulnerable, along with the scores of unpatched IIS boxen around. That got your attention yet ?

Read more at alphaque.com.