Protego Networks' MARS Appliances Detect and Stop Bagle/Beagle Worm by Default; Combines Anomalous Behavior Detection and Network Security Topology.

Business Editors/High-Tech Writers

MILPITAS, Calif.--(BUSINESS WIRE)--Jan. 21, 2004

Protego Networks Inc. announced today that the MARS appliance will detect and halt the rapidly spreading Bagel worm in real-time using default system rules. Customers hit with Beagle (aka Bagel) were immediately alerted to the threat and provided specific mitigation instructions.

"MARS was designed specifically to stop these kinds of new attacks," says Partha Bhattacharya, CTO of Protego. "Detecting known attacks is not rocket science -- traditional anti-virus and intrusion detection/prevention products do that quite well. Detecting unknown threats for which no signatures exist is a much harder customer problem. Protego's comprehensive model of network topology and security policies enables the MARS appliance to not only detect anomalous behavior like Beagle, but also determine with great precision exactly how to stop it."

Beagle is a mass-mailer worm that targets windows users. It arrives via e-mail with the subject "hi", body containing "test" and a randomly named EXE file attached. Clicking on the attachment launches the worm, which opens up a backdoor on TCP port 6777 that allows a remote attacker to download and remotely execute malicious programs on the infected host. The worm also broadcasts the location of the infected host to a list of foreign Web sites, and propagates itself to locally discovered e-mail addresses. This behavior generates a sudden increase in activity on SMTP TCP port 25 and on the backdoor TCP port 6777. These anomalous traffic patterns trigger the default "Increased Traffic to a Port" Rule which comes with every MARS appliance. MARS notifies the operator of the Incident in real-time, providing a dynamic attack-path graph and specific commands to isolate and stop the attack at the switch port, router or firewall level.

Protego Networks' Mitigation and Response System (MARS) provides all the benefits of Security Information Management (SIM), plus the ability to prevent intrusions and policy violations. The MARS Appliance reduces the burden on critical security personnel, enabling them to respond quickly and decisively to incidents.

Protego Networks also notifies customers by e-mail of security threats and solutions using their MARS appliances via periodic Security Threat Advisories. More information about this specific threat can be found on our Web site at: http://www.protegonetworks.com/support/sta2004-1-21.html.

About Protego Networks Inc.

Protego Networks Inc. is the first company to deliver purpose-built appliances for real-time Security Threat Mitigation. Our innovative MARS appliances allow organizations to centralize security information and quickly identify, analyze and respond to security threats. Protego Networks Inc. is a privately held company founded in 2002, with headquarters in Milpitas, Calif. with offices in Boston, Washington D.C., Toronto and London. For more information, call us at 408-262-5220, or visit us on the Web at http://www.protegonetworks.com.