Mon, 03 Jan 2000 12:04:38 -0600

Network Associates Recommends Continued Caution as Corporations Return to Work After Quiet Y2K Weekend Continued Vigilance Necessary Even After Uneventful New Year's Holiday As Potential Viruses May Be Lurking in Email for Returning Employees


SANTA CLARA, Calif., Jan. 3 /PRNewswire/ --

Network Associates, Inc. (Nasdaq: NETA) today reminded companies and

consumers of the need for continuing "safe computing" practices as they

return to work after the New Year's holiday. Recognizing that the limited

virus threat throughout the holiday may result in a feeling of false

security, Network Associates reminds IT Managers that the potential for

damage from new viruses or security holes still exists. Network

Associates' McAfee AVERT (Anti-Virus Emergency Response Team) will remain

in high alert posture for the next 72 hours, as the majority of computers

worldwide are powered up for the first time this millennium on the morning

of January 3. "We are pleased that the New Year's holiday did not pose any

strong threats to our customers, as the potential for Y2K damage was very

real," said Sal Viveros, director for McAfee Total Virus Defense at

Network Associates. "However it is essential for corporations to stay on

top of virus happenings and be especially alert this week as computers are

re-booted, and email between users and the outside world begins to flow

freely again." "Melissa was one of the most destructive viruses of 1999.

This virus spread at lightening speed through email attachments. It was

discovered on a Friday morning, and had spread world-wide within six

hours," said Jimmy Kuo, director of AVERT anti-virus research. "Because

these viruses can strike at any time, and the threat continues, this week

AVERT will staff the CyberAssurance National Information Center, which is

part of the President's Council on the Year 2000 Conversion Information

Coordination Center."



From December 30 through the turnover to the new year, McAfee AVERT

researchers found seven low-risk viruses, which represents the average

amount of virus writing activity AVERT usually experiences during a

four-day timeframe. There has been no indication that these seven viruses

are actively spreading in customer sites at this time. Nevertheless,

AVERT's worldwide research and support team will continue to monitor for

the spread of these viruses as well as any new viruses released during the

New Year. For details on the seven new viruses as well as continued

updated information on newly discovered Y2K viruses, visit the AVERT Web

site at: http://vil.nai.com/villib/alpha.asp.



Network Associates is double-click on email attachments -- save and scan them first

3. Keep software updated.

4. Turn on Macro Virus Protection.

5. Be cautious with free downloads.

6. Guard your personal and financial information.

7. Protect your personal computer.

8. Protect your passwords.

9. Teach children online safety tips.

10. Protect online transactions by using a secure browser.

11. Bonus tip: Be careful -- but don't believe everything you hear.



The McAfee Total Virus Defense suite provides comprehensive anti-virus protection at the desktop, file server, groupware server and Internet gateway. Powerful integrated management tools make it easy for

administrators to deploy updates and upgrades, and to configure and monitor virus security enterprise- wide. The McAfee Total Virus Defense product line is sold as a standalone suite and as part of the Net Tools Secure suite, Network Associates' comprehensive security suite incorporating anti-virus, firewall, encryption, authentication, intrusion detection, vulnerability assessment, and security management. Network Associates' McAfee AVERT (Anti-Virus Emergency Response Team), a division of NAI Labs, is the largest network of virus researchers in the industry.



During the week of January 3, AVERT will continue to work 24X7 around the

globe to provide the latest in virus research and anti-virus solutions.



With headquarters in Santa Clara, Calif., Network Associates, Inc. is a leading supplier of enterprise network security and management software. Network Associates' Net Tools Secure and Net Tools Manager offer best-of- breed, suite-based network security and management solutions. Net Tools

Secure and Net Tools Manager suites combine to create the Net Tools solution, which centralizes these point solutions within an easy-to-use, integrated systems management environment. For more information, Network Associates can be reached at 972-308-9960 or on the Internet at http://www.nai.com. NOTE: Network Associates, McAfee, Total Virus Defense, VirusScan and Net Tools are registered trademarks of Network Associates, Inc. and/or its affiliates in the United States and/or other countries. All other registered and unregistered trademarks in this document are the sole property of their respective owners.



Christopher Michael

Network Associates

Channel Security Products Manager


Computer security teams brace for attacks
By Stephen Shankland
December 20, 1999, 1:30 p.m. PT

Computer security teams are bracing for attacks by two programs that enlist multiple systems to launch coordinated attacks on Web servers.

Concern is mounting that the two programs, called Tribe Flood Network and Trinoo, will show their colors in the near future.

The programs, when installed onto hundreds or thousands of computers, simultaneously bombard a select point on the Internet. If the information from the attackers comes fast enough, the target computer
freezes up.

Flooding attacks such as Tribe and Trinoo are examples of so-called denial-of-service attacks, a method that's been around as long as there have been networks to inundate. Launching attacks from several computers also has been tried before, for example with the "Smurf" attacks of last year.

But Tribe and Trinoo give a new level of control to the attacker, and the attack programs are being improved, according to Dave Dittrich, a computer security technician at the University of Washington who wrote analyses of the programs.

Tribe and Trinoo, which started appearing in recent months, "are a step above what has happened before," he said.

Moreover, because the origin of the program is obscured, it's hard to counteract, said Quinn Peyton of the Computer Emergency Response Team (CERT) at Carnegie Mellon University.

Experts fear that the holidays are a likely time for such attacks, because computer administrators on vacation will be harder to locate and likely won't be paying as much attention to systems under their control. In addition, some suggest attackers are likely to strike in the midst of confusion that people expect with the arrival of the Year 2000 computer problem.

"There are machines now sitting there, prepared to attack somebody else," Peyton said. "Now one person can do a massive denial-of-service."

CERT warns that the Trinoo and Tribe attack tools "appear to be undergoing active development, testing and deployment on the Internet."

Tribe Flood Network and Trinoo launch their attacks from a host of innocent computers that already have been broken into. Then, on a signal from a master computer, the computers simultaneously bombard the victim machine with packets of information so fast that it becomes unresponsive. At that point, the target computer won't respond to commands and can't be taken off the network.

The FBI in 1998 set up an office called the National Infrastructure Protection Center (NIPC) to monitor computer attacks and vulnerabilities. Although FBI officials did not comment on the Tribe or Trinoo attacks, the FBI is holding a news conference tomorrow about Y2K issues, a spokesman said.

"There's a lot of paranoia for the Y2K stuff," said David Crawford of the Energy Department's Computer Incident Advisory Capability. CIAC is working hard to prepare a description of how to identify Trinoo and Tribe in the next few days. "We're looking for a unique signature that will identify these types of attack," he said.

Dittrich should know. He had to respond when 27 computers at his university were among 227 that attacked the University of Minnesota during three days in August.

"I was having a hard time finding all the people and getting all the systems cleaned up," he said, and that was just for the a small fraction of the systems involved.

"During that time, their network was pretty much unusable for 100,000 users," Dittrich said. "There isn't much of a defense against these denial-of-service attacks."

University of Washington computers also were used for attacks on computers in France, Norway and Australia, he said.

The attack software was installed primarily on computers using Sun Microsystems' Solaris and Linux--both variations of the Unix operating system. To break into those computers, the intruder took
advantage of known vulnerabilities that allowed him or her to take almost complete control of a computer then erase his or her tracks, Dittrich said.

"The core message is that people who have systems on the Internet need to know how to deal with them," Dittrich said. "You can't expect your computer to be running for years, like a microwave. It's more like a really expensive car, where you've got to be taking it in for maintenance all the time."

In the attack on the University of Minnesota, 114 of the 227 attacking systems were part of the Internet 2, a higher-speed successor to the current Internet. Using Internet 2 was important, because its higher-speed network can deliver more volleys in the denial-of-service attack.