Slashdot Mirror
RPC DCOM Worm On The Loose
GPez writes "The first of I'm sure many RPC DCOM worms affecting Windows is on its way, according to the Internet Storm Center. Patch those systems!" According to the site, "The worm uses the RPC DCOM vulnerability [affects Win2k through Server 2003] to propagate. Once it finds a vulnerable system, it will spawn a shell on port 4444 and use it to download the actual worm via tftp."
The security team at my office has been scrambleing to secure all of our systems before such a worm was developed. I hope they are done!
Will blocking port 135 at the router stop this worm? Seems like a simple solution for the short term. I would like to see the source for the worm, does anybody have it?
Visualize the world of wine
It's called a firewall. It's proteced me from Nimda, Code Red, etc.
Karma: The shiznight, mostly because I am the Drizzle.
Developers developers developers..
...
erm...
security security security... erm
um...
somebody get me more cocain!
the call centre here is off the scale with people ringing in with rpc problems...
all xp users though
"I disapprove of what you say, but I will defend to the death your right to say it." - Voltaire
At least Microsoft was nice enough to credit LSD in the tech note.
Learning HOW to think is more important than learning WHAT to think.
if you use this vunerability against someone (usually people that hit your web server with /default.ida) you get access to a C:\ prompt. You can look around, run format, etc.
It's quick to crash the machine (apparently) as the remote becomes unusable (pingable though).
It's actually pretty nasty from what I have seen... I just wonder how effective the worm will be when the machine becomes unresponsive after a few commands?
Perhaps it won't spread as fast as others because of this problem? I suppose we can hope.
Developers: RPC DCOM Worm On The Loose
Shouldn't that be:
Developers, Developers, Developers, Developers, Developers, Developers, Developers, Developers, DEVELOPERS!, DEVELOPERS!, DEVELOPERS!, DEVELOPERS!, DEVELOPERS!: RPC DCOM Worm On The Loose
After reading the advisory, it looks like this one is going to be a bad one. I'm no expert, but I would guess that this thing is going to be around as long as code red was (and I'm still getting code red hits in my logs!)
This worm is bugged it seems. From XP systems I have seen it throws an error to the screen about RPC services and reboots the system. On Windows 2000 Pro it crashes the svchost and a lot of stuff stops working. Just and FYI for those trying to diagnose systems right this minute.
Cagliostro
Papa Legba come and open the gate
UNC-Chapel Hill South Campus [Medicine, Pharmacy, Nursing, etc] has been slammed by this thing.
The tragic part is that Microsoft posted the patch almost a month ago:
I was working on my parents compter (Windows XP) remotely today when this started happening. I was installing some new software for them and I had also just disabled that stupid Messenger service so they would stop getting those pop-up spam messages.
:)
Anyhow, I had just finished that when XP said it was shutting down in 30 seconds. I was like, WTF!
Here I am thinking that I just screwed up their machine with the new apps somehow.
Thanks a bunch, Billy. Guess they'll be punting this one to Longhorn
Hello everyone ..
... Seems a worm has been released. We have received a number of calls about peoples systems shutting down with the following error: NT Authority System .. ect ect.
:)
I work for a small ISP
And the computer restarts.. This happens about every 40-60 Seconds making it "almost" impossible to Patch the Computer. Just a heads up for ANY IT Guys out there
This is our number of dropped TCP 135 requests at our border since noon today, per 30 mins, seen on our 2 Class Bs:
57,003 1200 to 1230
75,317 1230
59,321 1300
52,642 1330
130,932 1400
202,996 1430
277,183 1500
247,682 1530
320,919 1600
361,504 1630 to 1700
milspec
Affected Software:
* Microsoft Windows NT(R) 4.0
* Microsoft Windows NT 4.0 Terminal Services Edition
* Microsoft Windows 2000
* Microsoft Windows XP
* Microsoft Windows Server(TM) 2003
Not Affected Software:
* Microsoft Windows Millennium Edition
finally! all these years of running Win ME have paid off! so long suckers!
Both. It is opening a shell on port 4444 and contacting a tftp server (using the shell) to download a file which is the worm code itself.
OMG! It's not a worm, ITS SKYNET! It's taking over! Make your time, judgement day is nigh!
I've been digging around the web, and I can't seem to find out how to protect myself. I can't seem to find anything that prevents this virus from attacking my linux or as/400 servers. Help!
Got hit by this earlier today, I'm not normally a slouch with these things but this one really hit me hard, took me 4 restarts to find out what was going on. (As every time I connected to the net I was immediatly given 60 seconds before another auto restart) I can see how non-techies are gonna be totally screwed by this.
:)
All I can say is change the properties of your RPC service repair functions. Start -> Administrative Tools -> Component Services -> Services (local). this will at least give you time to go online and download the MS patch, which we should have done weeks ago I know
http://www.kb.cert.org/vuls/id/326746
win2k machines are still vulnerable to a dos; even patched.
Thanks microsoft...
Shell is on 4444. TFTP is on standard port. Random scanner? SHA-1 of packed worm is BED8E439F28A1A0D3876366CBD76A43CDCCF60FA. It'll lookup windowsupdate.com and flood on the 16th. Filename is msblast.exe, length 6176 bytes. Partial string "to say LOVE YOU SAN!!" appears even in the packed version (UPX 1.22). More detailed stuff to follow...
My JBoss server was listening on port 4444, so I got a call from the IS guys who thought my PC was compromised.
Everybody keeps posting that they have this or that port blocked on their firewall, so they're safe. Not so. All it takes is one person inside your network to open the wrong file attachment, or one laptop that went outside the network and then came back in to infect your internal network.
You did say this was a RPG worm, right?
It looks like the worm affects svchost.exe (the Generic Host Process), and keeps restarting the computer. At first I thought that some of my hardware was failing, but after reading dozens of posts on Usenet about similar problems, I wasn't really sure. So I researched a bit on Google, and found the MS security bulletin. After patching my system, the problems seem to have gone. I guess I should have followed more closely Microsoft's security announcements.
So, if you have strange issues with the RPC, or are experiencing similar symptoms as I have, patch up now!
Are there really that many win2k systems not even running SP3? That's not the only fix, but I have a box here that has had zero patches except SP3 and DCOM is disabled by default - which pretty much makes this "buffer overflow" a non issue. Doesn't XP also install (by default) DCOM disabled? So where is all this traffic coming from? People too nervous to install SP3? People too stubborn to stop using NT4?
Does anyone know if WINE supports this worm yet? I would like to test it out but I don't have Windows on my desktop.
Thanks.
A friend of mine called me about 3 hours ago saying that her brand new Windows XP notebook kept rebooting with some strange message about RPC. I had her download the free version of ZoneAlarm and that blocked the worm and let her stay online long enough to download the patch. If you know somebody that's getting hammered, have them give ZoneAlarm a shot.
Free Mac Mini. Yes, I'm
On XP you are getting two error codes.
The first is a system shutdown window tellign you that the RPC service must be restarted,. This gives you 30 seconds before reboot. Iniated by NT Authority\system. This is a succesful XP infection
The other is Windows cannot open this file:
File: TFTp784
This appears to be an unsuccesful try.
For windows 2000 it crashes svchost trying to get in it appears. Just apply the patch to stop the crashes. It does not appear to get into the system in this case
Hope this helps everyone
Cagliostro
Papa Legba come and open the gate
This is my first post - I'm just posting to say, that at about 1:00am today, I already found MSBlast.exe on my computer after a series of RPC errors. I patched using a file you can find in MS database: http://www.microsoft.com/technet/treeview/?url=/te chnet/security/bulletin/MS03-026.asp
And after cleansing my computer (and loading up Tiny Firewall 5.0) the problem is fixed.
Also a helpful hint in case you need it:
If you recieve an RPC error and a countdown is started to shut your computer down, then go to start>run and type "shutdown /a" and that will stop the countdown.
Hope this helps someone at least.
First worm? Nope. Second? Not even. I work at a university and we have been running around for a week now patching systems and fixing worms that started last week. They have hit NT 4 and 2000 machines. We found them by chance, but they are installing all sorts of things. Trojan.stealther is the one that hit hardest, on all unpatched 2000 machines. So this is not the first worm at all. They have been out in the wild for at least a week now, and we are now patching and fixing all the many hacked or vulnerable systems.
Enable Internet Connection Firewall, apply patch, remove virus :-)
The first is necessary because it is the buffer overrun which reboots the computer.
LedgerSMB: Open source Accounting/ERP
My girlfriend called me not 20 minutes before this article went up asking what RPC was and why it was shutting her computer down whenever she got on the Internet. A quick glance at this article's headline followed by a thorough read of symmantec's removal instructions led to me calling her back and another day saved! Thanks, Slashdot! Thanks, Symmantec Security Response Team!
Another comment was right - poorly configured firewalls will result in a HUGE problem. Here's the fix:
n and take out msblast there. Then run the patch from this site:
b cf ad8-afbc-458f-aaee-b7a52a983f01/WindowsXP-KB823980 -x86-ENU.exe
Control-Alt-Delete to get to Task Manager. Look for a process msblast. Kill that process. Using Task Manager, start a new process called regedit. Using regedit, navigate to HKLM\Software\Microsoft\Windows\CurrentVersion\Ru
http://download.microsoft.com/download/9/8/b/98
Restart. That should do it.
Sure there's a bug now. But Microsoft picking DCE RPC for DCOM was a nice thing for the open source community since its a documented protocol. There's a project supporting it on Linux: freedce. I have used freedce to communicate between Linux and Windows. It's nice.
At first, I couldn't figure out why Task Manager suddenly stopped working. Launching TaskMan.exe resulted in an error message "Task Manager has been disabled by the Administrator".
.dll file, delete them.
Odd, I thought. I *am* the administrator.
I realized I had been hit by a virus or worm when I rebooted and the autoexec.bat file opened up during my login. Not good.
Norton didn't pick up on this one at all; furthermore, McAfee's online virus/worm searching tool found a related virus, but not the actual baddie.
The virus that McAfee located - which probably came in after the worm opened up all those ports in my firewall - were in \WINNT\msagent\intl. Basically, anything in that directory that *isn't* a
The worm itself is in \WINNT\system32\, and is called 'msconfig[nn].exe', where [nn] is interchangeable with two numbers. Mine was 'msconfig35.exe', I've read reports on various forums of others w/ '32' and '33' after the 'msconfig'.
Be careful here, as this app will spawn identical, hidden copies of itself with random names (like 'dwigjenjig.exe' or 'zajdfanltef.exe'). The easiest way I found to discern between real MS files and the worm was by looking at the last modified date displayed by Explorer, vs the last modified date that pops up when you mouse over the file name. All of the worm files had discrepancies between the two.
Hope that helps someone out there!
And Cal(Berkeley) is blocking their network from outside access starting today for four days. Makes me wonder how many other large networks have been compromised, but don't know it.
I'm glad I don't work at Stanford.....don't envy them having to wipe 2,400 machines and sort through files that need to be replaced.....trying to avoid trojans, etc
~50 hits on my router in just the last half-hour or so, 90% of them from Rochester and NYC RoadRunner addresses.
I have a feeling this worm will hit especially hard on home broadband users that never touch Windows Update.
So i load up my /. as my homepage, take a look at the first headline, RP-What? Read up a bit, go: "Huh, that's interesting" and head off to my email site. Bam! i get pegged with this worm and my computer shuts down. For anyone else in the same boat as me, you can still download the patch using the infected computer by typing: services.msc there will be two services listed that are directly linked to this worm under the Remote Procedure Call heading, just look threw the list in the standard tab. You can by pass it by going into teh properties and changing the crash executions do "Do nothing" instead of restarting your computer. I was able to download the patch via the website and am now looking for a way to rid myself of this worm. Firewalls eh? I've heard of them, but then what else am I going to do in my spare time?
I've said it before, and I'll say it again.
While there is no excuse for not updating your systems, some people can't do so because of business policy reasons (non-tested patches against business critical systems).
EVERYONE with a server on the internet should also have Egress filtering in place. 486 mahcines are cheap. Unix/Linux firewalls are free. On the off chance you do get the M$ IS$ Worm of the week, at least your server can't initiate an outgoing connection to download more code and move on to the next system.
Just FYI, I've confirmed on my system that at least some of the parent's information is true. I got hit around 2pm Dallas time, and I've now got a file called msblast.exe in c:\winnt\system32 with a file length of 6176 bytes.
After the "to say LOVE YOU SAN!!" string, I find these words: bill gates you make hi possi. And before it, it looks like it says "I ju wan to say" (with control characters that may or may not be of interest).
Sure enough, Symantec has some info now, too (just sent by someone in my co.).
Timing sucks on this one -- I'm right in the middle of coding for 3rd quarter tax changes. Crap!
Stressed? Me? Of course not. Stress is what a rubber band feels before it breaks, silly.
And they don't block access to Slashdot? But it's full of Linux propoganda!
No, but slashdot sometimes blocks us because some corporate loser does something stupid. Then I have to change which proxy I use....
Andyway, due to the virus, I am really glad I am not working today, but I have had to send the msblast.exe to our virus reporting team, etc.
LedgerSMB: Open source Accounting/ERP
They did this already last week on Stargate SG1 with that virus that spread from gate to gate and took down the whole network in 2+ hours. Can't these virus writers ever come up with something original?
-- Thou hast strayed far from the path of the Avatar.
Internet Storm Center is getting hammered, so I attach their analysis.
u n, name: 'windows auto update'
\ Run
NOTE: the scanning is being done Code Red style, so it is concentrating on the class B pseudo-subnet, e.g. 123.123.x.x. If this gets inside your corporate firewall then you are screwed.
I count about 1 scan every 10 seconds at present.
--x8 Cut here ----
This RPC DCOM worm started spreading early afternoon EDT (evening UTC). At this point, it is spreading rapidly.
**********
NOTE: PRELIMINARY. Do not base your incidents response solely on this writeup. **********
Increase in port 135 activity: http://isc.sans.org/images/port135percent.png
The worm may launch a syn flood against windowsupdate.com on the 16th. It has the ability to infect Windows 2000 and XP.
The worm uses the RPC DCOM vulnerability to propagate. One it finds a vulnerable system, it will spawn a shell on port 4444 and use it to download the actual worm via tftp. The exploit itself is very close to 'dcom.c' and so far appears to use the "universal Win2k" offset only.
Infection sequence: 1. SOURCE sends packets to port 135 tcp with variation of dcom.c exploit to TARGET
2. this causes a remote shell on port 4444 at the TARGET
3. the SOURCE now sends the tftp get command to the TARGET, using the shell on port 4444,
4. the target will now connect to the tftp server at the SOURCE.
The name of the binary is msblast.exe. It is packed with UPX and will self extract. The size of the binary is about 11kByte unpacked, and 6kBytes packed:
MD5sum packed: 5ae700c1dffb00cef492844a4db6cd69 (6176 Bytes)
So far we found the following properties:
- Scans sequentially for machines with open port 135, starting at a presumably random IP address
- uses multiple TFTP servers to pull the binary
- adds a registry key to start itself after reboot
Name of registry key:
SOFTWARE\Microsoft\Windows\CurrentVersion\R
Strings of interest:
msblast.exe
I just want to say LOVE YOU SAN!!
billy gates why do you make this possible ? Stop making money and fix your software!!
windowsupdate.com
start %s
tftp -i %s GET %s
%d.%d.%d.%d
%i.%i.%i.%i
BILLY
windows auto update
SOFTWARE\Microsoft\Windows\CurrentVersion
Existing RPC DCOM snort signatures will detect this worm. The worm is based on dcom.c
Never email donotemail@WeAreSpammers.com
They *DID* put it on Windows Update. On 16 July.
The only reason we have the rights we have is that people just like us died to gain those rights. -- Cheerio Boy
Step 1. Shut down PC Step 2. Disconnect Network Step 3. Start up PC Step 4. Click Start -> Settings -> Control Panel Step 5. Double Click Network Connections Step 6. Right Click the Local Area Connection used to access Internet. Example: Local Area Connection 1 Step 7. Select Properties Step 8. Click the Advanced Tab Step 9. Enable the Windows XP Firewall Step 10. Click OK, Close out of open windows. Step 11. Plug in the network again. Step 12. Ensure Connection is stable Step 13. Open Internet Explorer Step 14. Go to the following URL: http://www.microsoft.com/technet/default.asp Step 15. Click the Link toward the middle of the page titled: Action: Read Security Bulletin MS03-026 and Install the Security Patch Immediately Step 16. Scroll Down Page about half way to Patch Availability Step 17. Click Windows XP 32 bit Edition Step 18. Click Download in the upper right of the screen. Step 19. Save the file to the desktop Step 20. Run the downloaded file. Step 21. The patch will install and prompt the customer to reboot. Step 22. Once the patch is installed and the computer rebooted, the Windows XP firewall can be disabled and the customer can surf normally.
Hate to say it, but the built in internet connection firewall in XP was dead handy - I couldn't stay online long enough to download the patch without being restarted, so i turned it on before connecting, and no problems since...
Darn, I really need to configure wingate properly, thought i had it tight...
Step 1. Shut down PCp 15. Click the Link toward the middle of the page titled: Action: Read Security Bulletin MS03-026 and Install the Security Patch Immediately
Step 2. Unplug Cable Modem.
Step 3. Start up PC
Step 4. Click Start -> Settings -> Control Panel
Step 5. Double Click Network Connections
Step 6. Right Click the Local Area Connection used to access Internet. Example: Local Area Connection 1
Step 7. Select Properties
Step 8. Click the Advanced Tab
Step 9. Enable the Windows XP Firewall
Step 10. Click OK, Close out of open windows.
Step 11. Plug in the Cable Modem.
Step 12. Ensure Block Sync is established.
Step 13. Open Internet Explorer
Step 14. Go to the following URL: http://www.microsoft.com/technet/default.asp
Ste
Step 16. Scroll Down Page about half way to Patch Availability
Step 17. Click Windows XP 32 bit Edition
Step 18. Click Download in the upper right of the screen.
Step 19. Save the file to the desktop
Step 20. Run the downloaded file.
Step 21. The patch will install and prompt the customer to reboot.
Step 22. Once the patch is installed and the computer rebooted, the Windows XP firewall can be disabled
"Uh, WTF is SVCHOST.EXE, and why the fuck does it always bind itself to 445, and how can I make it stop doing that? I don't know what it's listening for, but I know that for what I'm using this box for, I don't need it, so why can't I disable the offending process?"
- Me, the first time I played with a W2K box.
"So SVCHOST does too much stuff to just kill it, but how can I at least stop it from binding to 445? I know I'm not doing anything on that port, and therefore don't want any process listening for data sent to it. Period."
- Me, after 5 minutes of trivial research.
"Crap, it looks like there's no way to stop SVCHOST from listening to 445. Guess I'd better install my favorite cheap-azz third-party software firewall and block it there. Once I've done so, I don't give a damn if SVCHOST still listens to 445, because unless there's a buffer 'sploit in the firewall software itself, SVCHOST won't get any of the traffic anyways."
- Me, after 5 more minutes.
"I knew this was gonna happen."
- Me, when I read about the DCOM hole last month.
Security is a process, not a product. The process is "Everything is forbidden except what is permitted. Run no services other than the bare minimum required to get the box to bring up a GUI. Run no services that listen to any network traffic unless explicitly started by the user."
Insecurity is a product, not a process. The product is "DCOM should be on by default because pointy-haired bosses won't be able to do $NEW_OFFICE_SUITE_FEATURE without it, nobody buys the OS for anything other than running Office and Outleak."
Repeat ad nauseam with IIS on/enabled by default (CodeRed), the ActiveX/scripting settings for MSIE (Drive-by downloads), the out-of-the-box UPnP vulnerability (port 1900), popup "spam" (port 135), etc.
Basically, every time M$ has the choice between security (Built shiny thing. Disable by default and have applications respond with an error message telling users how to turn shiny thing on if and only if the shiny thing is required by some user action), and stupidity (Oooooh, shiny thing! Enable by default and assume there are no bugs in the code anywhere!), Bill and friends have chosen stupidity.
According to this slashdot post it says Win2k - Win2k3 is affected. Microsoft's page says the exploit is available in NT4.
We're currently got 112 windows Xp lusers in our queue looking at a 2 hour wait time to talk to us virus removal techs. "Sorry, no removal instructions, call tomorrow." hehe
A lot of people seem to think the executable is bugged, crashing the RPC service and causing Windows to shutdown. Seems like a good payload to me. In my example, my computer shut down within a few minutes. This makes it exceedingly hard for people to find information and download a patch to fix it, yet at the same time, the trojan is scanning and infecting others while you're trying to fix it. I was struggling to download the patch on modem, took about 5 shutdowns until I had it. Also, at this moment, the main cable provider in the UK seems swamped with this problem, and I don't think it'll go away fast.
If any Windows shops actually get hit hard by this, the Sysadmins need to be reprimanded or fired. My Co-Worker and I manage about 375 PCs at a University which has no firewall, though the NetBIOS ports are blocked at the border router.
You should have had auto-updates turned on for your boxes and/or been using SUS server to push these kind of updates out. We had autoupdates on, and then when the free scanner tool from eeye.com came out last week, we used that to scan the rest of our machines to identify any that didn't get the patch yet (not everyone has bene migrated into our domain yet, and there are some rogue NT 4 boxes around still).
As a result, we had everything reasonbly secure last Monday, and AFAIK there are no vulnerable machines on any of our subnets, according to my scans.
So, uh, what were you other Windows admins doing when you should have been doing your job?
When in danger or in doubt, run in circles, scream and shout. --Robert A. Heinlein
That fix has been there for almost a month. So... shut up, please. There's nothing worse than going off on a "OMG, M$ suxx is teh gahyest!!1!!" rant when you're just plain wrong.
SecurityFocus has an analysis for the worm here.
if you read /., don't run a firewall, and then complain about M$, all i have to say is, "phtttbht." linux needs patching, unix needs patching, M$ needs patching...but this worm would not propagate with a properly configured firewall in place, making the security patch a little less critical.
the fact that people are getting hit with this worm indicates that there is simply not enough education about computer security out there, or that there is too much laziness from both consumers and software licensing companies.
this worm is not an issue to people with the correct closed ports...
man rtfm
I'm only KIDDING, jeez!
I don't think this is a troll. It's a valid comment. The moderator that modded this troll is probably a Windows admin who's just realised that s/he's been infected.
Get your own free personal location tracker
That's not generic advice for the DCOM bug - for that you'll need to catch whichever of the MS ports are being abused this week. But it's guesswork advice for this particular instantiation of a worm that's exploiting it so you can at least slow down this one and isolate damage, and work on patching the actual holes in Windows so that you can prevent next week's worm that uses the same bug but some other inter-worm communication path from getting in.
At least on the couple of machines I've looked at, TCP 4444 isn't used for anything (there's a UDP 4444 used for Kerberos 4-to-5 conversion or something.) TFTP gets used for things like uploading operating system versions to diskless PCs and routers, and still isn't something you should be accepting from the outside world, and for the most part (YMMV) is only used by administrators who are better off stomping worms first and upgrading routerware later. The Microsoft ports are used by all kinds of Microsoft applications - you almost certainly should be blocking them to and from the outside world, but whether to block them inside your internal nets, and where, is a decision you'll need to make based on how much of which MS network products you're actually using. (e.g. you don't want to kill all your thin-client PCs by killing off their mounts of the file servers - but you also don't want them infecting each other.)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Here's a work-around I've been talking some of my relatived through tonight. It's not something I'd normally want to expose them to, but it certainly saves me a visit to do it myself!
While it is true that people should be patched; this worm can still damage stuff on patched servers.
If the server is not firewalled, but it is patched, the msbash.exe worm probing can crash the RPC service. Which then crashes Exchange, Some AD stuff, some windows explorer stuff, and other things (including windows update). It can still bring the DMZ servers to their knees EVEN IF THEY ARE PATCHED.
You are only fully protected if you are both patched AND the 135/445 ports are shut off from the internet. (No naked DMZ stuff.)
I personally patched all the DMZ servers with the hotfix the day it came out, then some other servers with SP4 that included the exploit fix Only the SP4 ones are unaffected.
Note, I am talking about services available, none of the boxes in question actually got infected. The infection attempt caused the problem.
Naked un-firewalled computers are going to get this thing, and get it bad.
It will be interesting to see if that August 16th date pans out to be a dDOS or what...
[Note, auto update is fine for PCs, but is fucking dangerous for production servers. Sometimes the updates do not play nice with whatever is there, if it happens when so-and-so is on vacation there could be real trouble. Do what you gotta do, but I am never going to let MS put anything on my stuff. You'll probably see when someone figures out how to spoof that and gets all 375 of your boxes rooted due to Windows Update.]
I feel sorry for anyone depending on Windoze Update. Like many M$ products it's broken, at least part of the time. I'm pasting below a couple of posts from NT BugTraq and Full-Disclosure last month discussing this:
a ult.asp?pid=36&sid=1& A2=ind0307&L=ntbugtraq&F=P&S=&P=92 18
-----------------
Message: 16
Date: Wed, 30 Jul 2003 17:09:14 -0500
From: "Schmehl, Paul L" (email address removed)
To:
Subject: [Full-Disclosure] Patching networks redux
For all those experts who have mastered patching your networks, please ignore this post.
For the rest of you, testing has shown that some patch management tools are incorrectly reporting that MS03-026 is installed when it's not (notably Windows Update and Update Expert, among others.) The accuracy of the tool depends on how they check for the patch level. If they check the registry (like Windows Update and Update Expert do) they will *incorrectly* report that MS03-026 has been installed when if fact the files have not been updated. If they do MD5 checksums (like Hfnetchk or MBSA), they will correctly report the patch level.
The Retina tool from eEye (and I would assume the IIS commandline tool as well) is correctly reporting what *is* patched and what is *not* patched, so you need to rely on those to give you accurate information. You could actually have users going to Windows Update and finding no patches available when in fact they are still vulnerable. You could also have users for whom you've pushed out the patch who have overwritten the files with older versions, yet your tools are reporting them as patched.
Of course the experts never have these problems, but for the mere mortals, caveat emptor.
Paul Schmehl (email address removed)
Adjunct Information Security Officer
The University of Texas at Dallas
-----------------
http://www.ntbugtraq.com/def
MS03-026 - are you patched? Windows Update isn't sure!
Content-Type:
text/plain; charset="iso-8859-1"
FYI, it is worth reminding people that some patch checking tools don't do a complete check. Windows Update doesn't check files, and it would seem that other products have problems also.
Some tools only check for the presence of a registry key indicating that a hotfix was applied. Other tools, such as Shavlik's HFNetchk and MBSA (and others) actually check file details, including a checksum, to verify that the files in play are actually the right versions.
I was speaking with Jeff.t.Parker @ hp.com about this issue. His observations confirm this (see below). If patched files are reverted to previous versions, for whatever reason, Windows Update and (at least in this case) Update Expert (and possibly other such tools) will incorrectly assert you have the patch applied when in fact you don't.
He wrote in to advise that Update Expert (v6.0 build 6069) is giving erroneous results at least in some cases. After applying SP4 concurrently with MS03-026 (using Update Expert), Jeff noticed some interesting results. The resulting versions of the files contained in MS03-026 on some machines were;
5.0.2195.6692 ole32.dll 5.0.2195.6701 rpcrt4.dll 5.0.2195.6702 rpcss.dll
This led to Windows Update and Update Expert both reporting that the systems had MS03-026 applied (wrong). MBSA and eEye's Retina both said the systems *did not* have MS03-026 applied (right).
While this may be a problem with the way Update Expert deploys Service Pack + Hotfix combinations, it also demonstrates the problem Windows Update has by not being able to examine file details (relying only on registry entries).
How many systems are out there now who believe they have MS03-026 applied, can't get it offered to them from Windows Update, but in fact don't have it applied at all??
Cheers, Russ - NTBugtraq Editor
-----------------------
spam popups every day; port 135 wide open, DCOM blazing away
Post-SP3:
no popups; port 135 still wide open, but not much there because DCOM is now DISABLED.
Like I said: it's just a "junk box" I setup the other day because the power supply died in my "good" server box. I haven't installed the googleplex of win2k patches because I don't think it's worth it - I'm only using it temporarily and if it gets hit I'll reinstall the OS (or stick a freesco floppy in the drive and reboot). This is just something I noticed when I read today's "warning" and went into that machine to disable the offending service.
"My Co-Worker and I manage about 375 PCs at a University which has no firewall," ... fired."
... fired."
... fired."
"the Sysadmins need to be
"You should have had auto-updates turned on for your boxes"
"the Sysadmins need to be
"We had autoupdates on,"
"the Sysadmins need to be
Reasonable boarder security, strict firewall rules, roll-over security, implementing patchs and updates after they've been tested within a "sandbox" or other non-production machine, and constant security/threat analysis - these are the building blocks to a secure and operational infrastructure; not turning on "auto-update" for all your windows boxes. That's absolutely ridiculous. Next time a faulty patch comes down the line, it's going to take down some, most, or even all of your machines. I can remember Microsoft security patches causing anything from network connection problems to out-right system corruption requiring repair/reinstallation of the OS. Be very careful throwing stones at other admins when your own procedures are just plain laughable.
"So, uh, what were you other Windows admins doing when you should have been doing your job?"
Where was I? Reviewing the procedures I have in place to ensure that this type of vulnerablity never touches anything that would be vulnerable to it, and ensuring that all critical systems are buffered in case of internal infection through user stupidity. Where was I? Doing my job, correctly.
-- "Government is the great fiction through which everybody endeavors to live at the expense of everybody else."
Nice try, but that bit about having a girlfriend was Just Too Obvious.
Someday, you're going to die. Get over it.
*sigh*
One line blog. I hear that they're called Twitters now.
In order to patch an infected system while
/windows/system/msblast.exe file and then keep it open with word. The file lock kept the msblast.exe from restarting on my system when connected to the net.
connected to the net do the above steps look for both MSBLAST and msblast in the registry.
Also create a
!joatlanta@@yahoo.com
Just bought my wife a new XP machine - because she has been having issues with the crappy linux boxes I have given her [300mhz should be fast enough for anyone...](all of my machines are Linux - daughter has an old win98 and a linux box on kvm).
...BAM! again... This time its an 'RPC' call error - 'shutting system down' message. Crap. I shut the system down and pull it completely off the network.
/. and see this post about the worm. I do a little forensics and find the c:\winnt\system32\msblast.exe, and c:\winnt\system32\pre[a-Z*]\msblast.exe.23oiu4i734 - I assume the pftp scratch file. Son-of-a-bitch.
She complained that her computer was shutting down all day - get this, I don't have any ports enabled on my router - its closed tighter than duck's ass.
So, I'm sitting there, and she decides to turn her machine back on - a few minutes later....BAM...my whole DSL network goes down.
So, not making the cause and effect connection, I call my local phone company. They are able to ping my DSL modem. So they go through the motions, and get me to hook up my XP machine to the network directly through the DSL modem...friggin' brilliant. I hook it up, and
I then check my linksys router - everything on it is reset to the defaults...everything. No ppoe settings, no password [its set to the default] - nada, nothing, zip.
I reset everything, and up comes my network - thats when I browse on over to
I also look for the registry entry to restart the worm - but don't find it (so far, so good). I delete the scratch file ok, but the msblast.exe file will not delete (the system says the wheel user isn't authorized - what kind of Mickey-Mouse operating system is this!!?)
I want to know:
1. how to clean this up?
2. how the hell did this thing ZAP my Linksys with all the ports disabled?
3. where the hell can I get my $99 back for this bogus operating system?
Lodragan Draoidh
The more you explain it, the more I don't understand it. - Mark Twain
Trend Micro says that this worm performs a DDoS to Windows Update Site, I'm not really sure about removing it...
-- When did Ignorance Become a Point of View?
To delete the msblast file, you may have to first open Task Manager, click the Processes tab, highlight the "msblast" process and hit the "End Process" button...then try to delete the file.
You want to know what a real University setting is like? I've worked at 2 of the 3 state Universities here, and generally it's a mishmash of 20% Win95, 40% Win98, 20% Win2000, and 20% Windows XP machines, none of which authenticate to a domain, administered by someone who started working there as a student, but was kept on after graduation because they were cheap labor.
Patches? Well the user should take care of that, right? After all, they've got Internet Explorer, they can surely remember to visit WindowsUpdate and get patches on their own.
Oh, AntiVirus definitions? Well, our software doesn't update those automatically, you've got to click the icon and push update every month or so, but the users can do that.
None of the above is hyperbole, and were actually the standard practices as recently as 18 months ago.
Heck, doing testing? That'd require a SECOND computer for each technician! That'd cost money! We can't afford to but TWO computers for one person, we're already splurging on 1 IT person per 500 computers! Oh, and we gave you 1 student who's slightly above minimum wage too. What more do you want?
When in danger or in doubt, run in circles, scream and shout. --Robert A. Heinlein
Anyway, the one thing I found that killed them both is Notepad. Just open up the executable in Notepad, type a few random characters here and there, erase some things, mess up the file header, and then save right over the virus! They're never expecting that. Make sure to kill the virus processes first, of course, or else you'll get the infamous "access violation". (In the case of msconfig32.exe, you must use the command-line tools 'tasklist' and 'taskkill') The viruses might restore themselves if you remove them from the registry, or delete the file, but they're not expecting you to corrupt the executable. If Windows, in its infinite stupidity, tries to run the virus again, it will fail harmlessly.
P.S. I know, I know, you're wondering why I'm running an unpatched XP install on my desktop. Well, I just reinstalled, and only have dialup, and I'm going back to college in a month where there's super-broadband. Downloading 30+ MB (conservative estimate) of service packs, patches, hotfixes, and updates over dialup (not even 56k, more like 28.8) seems pointless. Besides, it's interesting seeing actual virus infections happen and fixing them myself. If anything goes horribly wrong, I have my XP cd right here to reinstall again. I'll be reinstalling and patching when I get back to a real internet connection.
main(c,r){for(r=32;r;) printf(++c>31?c=!r--,"\n":c<r?" ":~c&r?" `":" #");}
Apache (running on my aforementioned patched win2k server) keeps logging a bunch of http requests matching that of code red... appearantly even that one is still floating around.
"I guess I wonder why windows can't make it more difficult for people to create self spreading virus ? Linux, BSD, and UNIX don't SEEM have these self spreading virus. Don't you ever wonder why MS with all is billions of spare dollars, can't prevent this?"
Actually, Linux has some known (nasty) worms out there, too. I should know, one of my linux servers was hit by a nasty one a couple years ago. Now, had I kept up with security notices & patched my systems more regularly as I do now that wouldn't have been a problem. These days I am on the CERT advisory mailing list, and a few others as well.
It seems that it had caused a worldwide panic!
:)
I am a university student in China mainland, we connect to the internet via firewall of our university. in the recent days, many computers in local network were attacked by hackers using RPC vulnerability. PCs which were attacked reboot without any reason. Some displayed "scvhost.exe runtime error! The computer is going to shutdown within 60 seconds..."
Someone told to run Dcomcnfg.exe, and disable "Windows Distributed Component Object Model " would be help. I was wondering why? and if that really works. For I have installed the patch for Windows XP, so I can't check it myself.
ps: It is the first time to post reply on slashdot.org.
Philip Hsie! Make it possible!
Here's the homepage for Symantec's tool which removes this worm.
Woopty Doo Basil, what does it all mean?!
I've noticed that just recently the media is reporting more detail about computer viruses. In the past, they would just mention that a virus was spreading, maybe how many computers are affected, and that was about it. Now they often report the afflicted operating system, which we all know is almost always Microsoft's demon seed. Maybe the average computer user will learn that Microsoft is totally insecure and cause them to have second thoughts about upgrading to Microsoft's next great OS. But at least the media is no longer hiding this info from the public, who probably thinks that computer viruses spread to all computers equally on the Internet, and don't understand how specific viruses really are 99% of the time.
pot.kettle(black);