Slashdot Mirror
Win32 Blaster Worm is on the Rise
EvilNight writes "You know you've got it when a 60 second shutdown timer pops up on your screen. The virus uses the RPC vulnerability. It looks like it's reaching critical mass today. Luckily, it's an easy one to stop: Download this security update. Once you've installed that patch, go here and
download the removal tool." Update: 08/12 19:19 GMT by M : Security bulletin URL corrected.
My friend was getting hit constantly by this worm yesterday. The box wouldn't stay up long enough for him to install the patches :P. Just a tip for those of you who are getting hit a lot and having your box reboot: To stop those pesky reboots try:
/a
shutdown
That should abort the shutdown and give you enough time to install patches. This also works well when you install a piece of software that trys to force you to reboot. (Why he hadn't fixed it already is a mystery, especially since slashdot.org is his homepage.)
Visualize the world of wine
posted an article about it here http://www.baxter2.com/modules.php?name=News&file= article&sid=114
i have never seen a worm spread so fast! dangerously fast
who wants to rule the world?
Someone in my office just gave me a screen shot of a shutdown timer on their computer at home. Anyone used the removal tool yet and had any luck with it?
666-607: 6th floor apartment of the beast
Shouldn't the "Removal Tool" link point to a Linux ISO download site or something? I mean, this is slashdot... :-)
DOOM-DOOM-DOOM-DOOM DOOM * PANG*
At 10:06 AM, August 12th, 2003, Skynet launched dah Win32 Blaster Wahm. It quickly seized contrahl of ahh computers on the Net and forced a mahndatory reboot.
OK this is getting old.....
fdisk :)
format
install FreeBSD or keep your copy of Winders up to date.
Dear all of you who are being hit by this attack:
Why hadn't you applied the patch before? It was released 7/16 and nothing has had this level of publicity before.
I've been helping my friends get this NASTYNESS off of their machines too.
Something else you might want to try is booting into safe mode (F8 right when Windows splashscreen pops). Deleting the registry entries, and the virus runprogram (msblast.exe). Also please... PLEASE patch your computer.
When you're done, run some AV on your system. Some ppl had a 2nd virus sneaking around that they didnt even know about (Spybot.worm).
-Tim
Yes, you can cancel this. Start up a console session (oh wait, this is Windows, it's called a command prompt) and type in:
C:\WINDOWS>shutdown -a now
Granted, this does leave your system in an unstable state, but if you have something urgent you absolutely need to get done, this gives you a few minutes to do it before you reboot.
"Hu, ho, ho-ah-oh-oh-oh. Hu, ho ho-ah-oh-oh-oh. Mario Paint! Whoaaa!"
Another article here
If this thing wouldn't keep crashing computers, it would be spreading like greased wildfire.
Read more on SecurityFocus' mailing list.
BOO! TERRO
Funny, a few days ago I had my XP system exhibit the same problem (after using windowsupdate)... but I checked the event log and it told me that 0x70/0x71 was accessed by the BIOS unexpectedly.
After doing a bit of research I discovered that at some point, microsoft decided that ACPI needs to behave differently, and forced all BIOS's to be upgraded to work with XP. After getting a new version of my BIOS, the problem disappeared... but the symptoms were identical to what is described with this bug... Bad timing I guess... But if you have this problem, check the event log, it may be your now non-compliant BIOS, rather than an infection/attack.
---
Programming is like sex... Make one mistake and support it the rest of your life.
My friends and I discovered that turning on your windows firewall (Windows XP) also stops the shutdowns. (Wish I had known that BEFORE I formatted my computer) Unfortunately, I told my parents about this 'epidemic' of computer error (I heard about it from my cousin in Kansas before it happened to me, and then some friends here got it at the same time), and I'm sure that now whenever something is wrong with the computer my parents will get a big serious face and say "You know, it's probably an epidemic".
I regularly report MSN spam to the Hotmail admins.
Please. I still remember when my system got hosed by a sendmail hole.
"Sufferin' succotash."
Internet Storm Center
Microsoft Bulletin
Note this is marked "Critical" now...
I had to patch several computers at work, and I noticed that the patch installer software says something at the beginning like,
"Back up all your harddrives, we are not responsible if this program breaks your entire computer. Do you Accept?"
Well in the middle of a virus scare, nobody has time to back up every machine in the office. So that really doesn't make me feel comfortable. So far, so good though. No broken computers as of yet.
But another scary thought that crossed my mind while installing the patch... What if those smooth criminals had gotten into the microsoft servers and put a virus into that patch installer? That would be a killer!
If you need to use Windows, you might as well use win98.
Slashdot Syndrome: the sudden, extreme urge to correct someone in order to validate one's self.
From Symantec's analysis:
If the current month is after August, or if the current date is after the 15th, the worm will perform a DoS on "windowsupdate.com."
With the current logic, the worm will activate the DoS attack on the 16th of this month, and continue until the end of the year.
Maybe this will motivate Microsoft to actually deal with the gaping festering security holes in their OS? How many systems do you think will still be infected after the 15th?
Nahh....
If you want to stop the timer from fscking with you, simply set your clock back a few hours right after the timer appears. Any time you subtract from the clock is added to the timer. This will give you time to install the patches. We got lucky, this one is mostly harmless. This vulnerability was patched on March 26th, btw.
Hell is being intelligent in a world full of idiots.
Having trouble getting out to Windows Update. Looks like a lot of people are taking this one seriously.
Chip H.
A few minutes ago (about 14:45 my time), I tried this:
grep "DPT=13[5-9]" messages | grep -c "Aug 12"
643
Then I tried this:
grep "DPT=13[5-9]" messages | grep -c "Aug 11"
643
So it took less than 15 hours to reach yesterday's 24-hour total. Doesn't look too good. I suspect that fixing this will prove to be way beyond the abilities of a huge proportion of home users of Windows. Anyone who says that "Linux isn't ready for your Grandma" or whatever, should be forced to do community service for a week fixing this crap.
Reality is defined by the maddest person in the room
Why-oh-why can't people patch? Shouldn't broadband providers be sending emails to their clients with a link in them? You'd think every hotmail account would get a message saying "Plug that hole" from whoever it is that runs hotmail. Even the most clueless of windows users can click on a link and then click the "Yes" button. I can see my logs filling with failed attempts to bring down my machine already...
No, I shouldn't. This worm isn't clogging up bandwidth or DoS/DDoS attacking routers and web servers like Code Red and Nimda did. This is just making WinNT and greater workstations and servers (should you actually be using a Windows OS on a server that isn't heavily protected) to reboot.
I run an ISP in Virginia, its nailing all of our Windows XP users.
I work at an ISP, and over half of our tech support calls yesterday were because of this worm. You wouldn't believe the number of people who thought we were somehow going into their computer and not only kicking them off the internet, but rebooting their computers. (Yes, sir, the tech support staff feels horribly underworked today, so we thought we'd make things more exciting and pi** off a few customers in the process.) I hope they find the person involved and perform medical experiments on him.
This tagline is copyrighted material. Please send $10 for an affordable replacement.
Then try, really, really hard to stop laughing...
Cheers,
Ian
Yeah... nothing like that.
Other of course than the multitude of root kits out there, sendmail holes, bind holes, apache holes, anything else holes.
And yeah. Linux 7.2 - guess you havn't been around long enough to remember.
RTL Z (national television, all day business news), the Netherlands, this afternoon:
It was said that if you valued security, Microsoft wasn't the best solution. You'd be better off with Apple or Linux.
This could very well be a (another) turning point for linux. Of course, by the time something like this happens to Linux, everybody is going to run the other way again, but it could give OS some inroads.
the pun is mightier than the sword
Man, it's almost as bad as that Teddy Bear virus *cough*
While you should have the MS03-010 patch installed, it is the wrong one for this worm. Make sure you use MS03-026. This is the patch that it links to in the removal tool link.
There was even a Slashdot article about the exploit. It was such a big deal because it was the first and only vulnerability for Windows Server 2003 so far.
All these people sarcastically saying to "patch with Linux" or "use the firewall" are missing the point that the smart people downloaded the 1.2MB patch last month and had no idea anything was going on until we read about the worm on Slashdot. My entire work network was unscathed, because they're all kept completely up to date. I can't think of any reason why someone shouldn't be doing the same to their Windows network, except for arcane Slashbot conspiracy theories or just plain needing to hate Microsoft for something, anything.
If this was a Linux worm, people would be telling everyone else that they should have patched to the latest versions of whatever. But, it's Windows, so it won't exactly happen that way...
"Sufferin' succotash."
Install now
karma capped
Windows is easier to pick up, but just as hard, possibly harder, to maintain than *nix. So you get less-trained or less-capable or whatever people who are employed doing this, who look fine on the day-to-day, but who are damn-near useless at the harder stuff like security - which should, of course, be the day to day.
Combine that with the sheer number of sever and critical patches MS expects you to apply, each of which must go through regression testing before deployment, and you can see why sticking the ol' head in the sand looks appealing...
J.
You're only jealous cos the little penguins are talking to me.
The Cert advisory can be found here
Start\Settings\Control Panel - Administrative Tools. Services. right-click "Remote Procedure Call (RPC)" hit Properties. click the Recovery tab. set "First Failure", "Second Failure", and "Subsequent Failures" to "Take No Action". that will keep it from trying to reboot as you clean. good luck.
here are some nice screenshots i made on the msblast and the hidden message "I LOVE SAN"
who wants to rule the world?
According to the Beeb and their article once on a "...machine the malicious program also launches an attack against the Microsoft site that holds a software patch that keeps the worm out."
Nice twist of fate
Jaj
Every Windows Sysadmin should check these sites daily:
TechNet
TechNet HotFixes
And
WindowsUpdate
It's really that simple. Check daily for patches on your software, patch it, reboot, get back to work.
I've been trying to get relatives to fix the Windows DCOM security hole. At least two so far have said "oh! I didn't realize that was a security problem!" They thought the RPC service failing and causing a machine reboot was your everyday "bug", and since it just rebooted the machine (and even gave you 60 seconds to finish up what you were doing!), that it wasn't a big deal.
I think the 60 second thing is seen as a feature - along the lines of "see! Windows knows when its going to crash and lets you save your work first. Like the computer on Star Trek telling you how many seconds until there is a hull breach."
All of them heard the news about a security problem. None of them connected it with the problems they were having.
Finally, to make matters worse, Microsoft's page talks about patching the system, but says nothing about removing the worm. This is problematic since, as noted above, it can sometimes be pretty hard to download the patch if your computer wants to reboot in the middle of the download.
To make this smile even bigger: Compile this and execute it as root (all ports below 1024 are restricted and needs root permission to be listened to)
Now you can actually *see* when the worm tries it's futile attack on your superior OS.
GAAH! MY PRINTER IS ON FIRE!!! PUT IT OUT! PUT IT OUT!
Seriously, best current practices dictate that before a compromised machine is reconnected to the 'net you:
Getting the patches without a 'net connection is left as an exercise to the reader.
I got the worm yesterday, and found that when the "shutdown" popup appears, just reset the system time... you have a full minute to that. I just pushed the data back one year, and the shutdown is postponed a year! then you can run a full system virus scan, and repair tools
Regards/
JP
The facts expressed here belong to all, the opinions to me. The distinction between fact and opinion is yours to decide.
I know this is Slashdot and all the Linux users need their daily affirmation that they are right, but guys, lay off the common user. To expect someone over dialup to have Windows XP patched with the 200 MB of updates since XP came out is rather harsh. I know this hits more broadband users, but working in tech support, we have seen a fair amount of dialup users get hit as well. So before telling the everyday user to switch to Linux for their home machine, maybe we should get Microsoft to check their product for problems before shipping it out.
Another quick fix if you don't have enough time to apply the patch before shutdown. Go into Administrative tools, Services, find the RPC service. It gives you options of what to do if it unexpectedly dies. By default, it is set to shutdown after 60 seconds. You can change this to "Do nothing". Make sure you set it for the 1st, 2nd, and 3rd warning. So basicly now it will die, but it will go un-noticed.
My wife calls me upstairs last night.."The machine keeps shutting down".. Me: "what" *looks at task manager* Task Manager: msblast.exe Me: "Why isn't the firewall turned on?" Wife: "I Hate having to answer all of its questions, so I turned it off." Me: AAAARRRGGGHHH
Luckily, it's an easy one to stop: Download this security update. Once you've installed that patch, go here and download the removal tool."
Not really... there have been several reports that the thing has flogged machines so badly that it might not be even posible to connect to windowsupdate/any other internet site. For proper removal instructions, take a look at CERT's advisory or Trendmicro's KB
My other OS is the MCP!
I welcome our new Skynet Overlords.
Oh, come on, people. He threw you a bone for fuck's sake. Linux 7.2? Sheesh!
Welcome to the corporate world. All things, including service packs, must be tested on all platforms with all applications before being deployed into the environment.
We don't have a couple dozen windows boxes. We have a couple hundred thousand. Patching is *painful*. We're not talking purely servers that are affected--standard workstations. Servers get patches at a much faster rate than the user desktops.
Even after the 4-6 months goes by and the patches get the official blessing for end-user install, users don't like watching the service packs run for half an hour when they login. Besides, who trusts the users to sit around and let them install without playing with stuff.
So....We filter internal site connections to try and contain infections, and work as quickly as possible to mitigate the risks of downtime for system updates vs. the risk of collateral damage (outages) caused by Microsoft's weak code and security practices (AKA bug).
After two years, we're almost done with the Windows2000 conversion, but Microsoft has already been pushing for immediate XP deployment for a year...
Why aren't they all patched? Because nothing moves fast in large installation bases.
Threaten to not paddle her - that might make her change.
(She might be darker than you think!)
Get your own free personal location tracker
Yes, yes, I know, this is /. and we all know this. My point is that the mainstream press is starting to make the distinction now.
A nasty work is quickly spreading across the internet forcing about 90 percent of the connected computers to become inoperable. Thousands of phones are ringing at IT desks all over the world. On the other ends of those phones are screaming, panicky users crying because their computers won't work. Management is calling because now you're the bottleneck causing inefficiency in the team, and you might need to start looking for a new job if this isn't taken care of. And then you trip over a network cable.
I think getting hammered is the best thing to do right now.
thanks to this worm, i've noticed a dramatic decrease in the amount of spam i'm getting - roughly 150 to 200 per day is trapped by my spamassassin install. Today, only around 10 spams.
I get enough junk mail as it is. I don't want to be reminded of people who are too stupid to patch their computer. Besides, it wouldn't work. Even though "the most clueless of windows users can click on a link and then click the 'Yes' button", remember that they DON'T. Windows update comes by default set up to check for updates periodically...then the screen pops up and asks you if you want to update. Unfortunately, the screen also gives you the option to turn off windows update, and that's what the clueless people choose, because they don't want to be "annoyed" by it.
Instead of bothering me with e-mails, Microsoft should remove the option to disable Windows Update from the "first use" screen. If you can't figure out how to go to system properties and disable/reschedule your windows update, you're not supposed to have it disabled. I think that would maintain quite a few computers with up-to-date patches.
Warning: Opinions known to be heavily biased.
Now, I didn't get hit -- between the firewall, ZoneAlarm and the patches, I think I'm Ok.
Design for Use, not Construction!
For once using Windows ME pays off!
Do you like BSODs?!? Don't you wish you could leave the server room for 5 minutes?!? Aren't you sick of data corruption??!
I wrote Win32 Blaster, and since installing it on our server, we haven't had any of these problems that plague Windows boxes around the world.
Being the nice guy that I am, I wrote some "Automatic Update" code, and fixed all your machines. And you call it a virus and complain about it.
I'm not helping you anymore... fix your own damned problems.
-1 Uncomfortable Truth
I patched my home machines probably within 24 hours of the patch being available. I've got a couple of machines, and nobody is depending on their uptime to make a living or maintain a professional corporate image. If only the real world were that easy.
My company lives in the real world. We were hit by this, but pretty lightly, a couple of machines and we were lucky enough to pull the plug on them and cut it off before it spread, mostly because I was monitoring slashdot, and I knew the symptoms of the infection the first time it came up internally.
Our firewall wasn't breached so much as apparently circumvented by a laptop belonging to a user that never accepted the patch -- he got the virus at home, then came to work and plugged in. I assume that just about any company with a firewall at all isn't allowing incoming TCP 135, so I'm guessing that hard-hit companies generally got it this way.
We had identified this patch as critical, even relative to all the other less-critical critical patches. That still meant we had to test it outside of production, which took some time, and we also had to keep an ear to the ground to find out if any of the (many) folks out there who apply patches without testing first had been burned by this one.
When we were satisfied at that point, we had made it available internally to all workstations via SUS -- worst case scenario here if the patch is bad is a lot of re-imaging, but no loss of data, no loss of critical network services, etc. We don't have workstations set to auto-install the patches, so that requires the user to click an install button to complete the process. In many cases, the users had done that. In some, they hadn't.
At that point we started pushing it out to machines via SMS, workstations first, and then starting to patch the servers. (I wish I could give you a timeline for each step here.) Again, we proceeded conservatively, not getting every box at once, and not letting SMS force our servers to reboot after the patch installation, but instead asking various sysadmins to schedule reboots for servers at an acceptable time as soon as possible after the patch was applied.
So, some servers were patched by yesterday. Probably half were not, especially if you count those that were patched but not yet rebooted, which you have to count as not patched, I guess. To my knowledge at this point, we cut this off before any servers were infected, which was really just luck once it was inside the firewall. It could have been worse, but at the same time, many of our boxes were safe by the time yesterday came.
Now, of course, we are frantically patching and rebooting. And if we had been a little more frantic beforehand, we could have easily had it done before yesterday. But little else is getting done today. We've got over 100 Windows servers to deal with here, production, development, testing, IIS, SQL, SMS, DCs, Citrix, physical machines, virtual machines, you name it. It is not trivial to get this job done. And doing it in a hurry is dangerous as well.
And we're lucky. All our boxes are at one location. I'm looking back at how we handled this, and I think that a little more focus and emphasis and we could have patched everything by now, but the attack could just as easily have come a week sooner, and we'd still be having this conversation.
The difficult truth is that, in many cases, it is possible to develop an exploit for a vulnerability more quickly than it is possible to adequate test and deploy a patch in a large and complicated corporate environment. You patch as quickly as you safely can while still getting everything else done, and you also take all the other steps you can to mitigate the damage if you get hit. That's the real world.
Let it be suffice to say that if a company is trying to sell you something based upon the FUD factor, treat the information as suspect. I agree, vendors whose software doesn't sell on its own laurels hype the hell out of the FUD factor and give the industry a bad reputation. But don't lump these vendors in with the security consultants that are trying to provide a free service and free advise based upon information that is going around in the security community.
When you get security information, consider the source. Is the security information provided with a sales pitch attached? If so, google the information to determine if it is FUD or legetimate. If it's legit, it'll pay to listen.
Regardless, people, patch your *#&($*@& machines!
Good security is based upon reality and common sense. Common sense is a function of having common knowledge.
All these crappy Microsoft net-enabled 'features' turned on by default are a menace to the average user and the Internet in general.
Please block TCP/UDP Netbios ports 135-139, as well as SMB over TCP(port 445), RPC over HTTP (port 593), the MS-SQL port the Slammer worm used (port 1434).
And I am sure there are many, many more.
If you have already the service pack mentioned in this slashdot article, then according to the Microsoft Security bulletin linked in the article you already have the fix. So you might as well get the whole Service Pack while your at it.
======
In X-Windows the client serves YOU!
BBC: Hidden inside the worm are two messages. One taunts Microsoft chairman Bill Gates and reads: "billy gates why do you make this possible? Stop making money and fix your software!"
why is this message "hidden"?
why not have the worm install a desktop wallpaper saying this? and a picture humiliating him in some way?
Think about this scenario: a perfectly competent administrator has a properly configured firewall which blocks the problem. The "road warrior" brings his laptop from from 3 weeks on the road and had used a bunch of hotel access points where he got the worm. He connects it to his docking station in the office effectively bringing the problem behind the firewall.
One of the first things I disable in Windows is 'automatic updates', and a lot of people think it's intrusive and won't use this feature. However, the patch for this exploit has been out for a month, and yet thousands of users are getting affected by this, me included. If people did allow Windows to automatically update, or even took the time to update it themselves, this problem wouldn't have been nearly as bad. Having said that, who here trusts Microsoft?
That's the legacy of MS policies like "DOS ain't done till Lotus don't run!"
You just know you'll let auto-update run and one day it'll "disable" your MP3s because WMV offer so much more security, or something similar.
Download this security update.
Where's the Linux version ?
:wq
Perhaps this is one of those extremely rare occasions where an anti-virus virus should be released. Windows users all agree to an EULA that says Microsoft has the right to install updates on their computer. If anyone has the legal right to create and release one, it's Microsoft. As that guy mentioned, it may be hard for many people to download the patches on their own because of reboots.
There are some legal issues associated with portscanning though.
Microsoft tested Windows NT 4.0 and Windows NT 4.0 Terminal Server Edition. These platforms are vulnerable to the denial of service attack however due to architectural limitations it is infeasible to rebuild the software for Windows NT 4.0 to eliminate the vulnerability.
Well, we patched what we could, and moved most critical services to Linux, but there's still one or two machines running NT. And it's only a matter of time before some luser slips a copy of this worm past our firewall....
Considering the amount if infrastructure that depends on NT4, doesn't this intentionally put the US at greater-than-necessary risk? I'd be fun to see M$ tried under the new anti-terrorism laws.....
would prevent the worm from copying itself to your system?
--
"Open source is good." - Steve Jobs
"Open source is evil." - Microsoft
Anti SCO T-Shirt. $1 donated to Open Source Now Fund on each shirt.
Maybe you could try Microsoft's FREE Software Update Service (SUS) which lets you download all updates to a centtral server, approve the ones that work and automatically deploy them to your Active Directoy clients - I patched 64 machines in less than 10 minutes of my time. I sure hope knowing how to use MIcrosoft products doesn't get me banned from Slashdot...
Vote Quimby!
Ummm... Isn't that what the automatic update thing does? You can set it to automatically download and install critical updates, or warn you when they are available. Am I missing something? It seems like windows has had this for a long time now.
T.
I was experimenting with nessus several months ago. I unchecked the "safe checks only" option and ran it against a series of internal Windows systems and crashed RPC. I thought "wow, this could be really dangerous if nessus'd a range of public IPs."
Sig is taking a break!
yesterday, regarding the worm. I was amazed how fast this virus spread... no other virus has created such a quick increase in call volume for us.
Of course, I work at an ISP... so when their Internet flakes out, we're the first thing they call. This is one of the first viruses I've seen that seems to deliberately crash your Internet connection, so rather than calling days or weeks later with some minor odd behavior, they called right away because their net was down.
I'm curious what will happen in a day when the timed DDOS goes off.
"I will trust Google to 'do no evil' until the founders no longer run it." Hello Alphabet.
From the Microsoft security bulletin on the vulnerability:
"This vulnerability only permits a denial of service attack and does not provide an attacker with the ability to modify or retrieve data on the remote machine."
The only, uhm, 'interesting' aspect of this worm is that on Friday it's going to nuke WindowsUpdate. The worm will probably never go away competely so W.U. could well be unusable for months to come. Totally predictable, of course, it's just a surprise that it lasted this long.
"None are more hopelessly enslaved than those who falsely believe they are free." -- Goethe
I think you mean lazy and incompetent admins, plus thousands upon thousands of home users who have no idea what a patch is, or what a firewall is, or what ports are in this context. It appears that you'd want nearly all home users of Windows XP to be "stoned, burned, crucified, sterilized and beheaded". That seems a bit extreme to me.
The reason I am gloating (I can't speak for other slashdotters) is that I'm sick of reading that Linux is not ready for the desktop because it's too difficult to use. I'm looking forward to the many many accounts of normal Windows users who are able to successfully patch their systems in the sixty seconds they have before it shuts itself down again.
Reality is defined by the maddest person in the room
When's the first computer voting machine going to be hit with something similar?
And will these problems again be explained as "user error"? (think Florida '00)
This is not my sig.
Seems to have done something though. I'm on a 512/512 dsl line and it took microsoft.com a full minute and then some to respond. The actual page load was fast enough though, so I'm guessing it's the connection limit. Only guessing though. It's hard to tell if it's the worm or the people desperately trying to get the patch, but the end result is pretty much the same.
... Isn't it funny that users don't patch when there's a threat that could wipe hard drives clean, but when something interrupts their daily pr0n wank with a reboot they rush at Mach 3 speed to get the fix?
Well, I'm in Philadelphia and I'm named Ian, but I'm from New Zealand.
However, my parents are originally from England, which means I have a distinct British tinge to my accent. Oh, and most of my family still lives over there...close enough?
(By the way, of course they're not all named Bruce -- that'll be the Australians.)
Then "no soup for you!" Microsoft has not and (at this time says) will not provide a fix for this. They claim that "the Windows NT 4.0 architecture will not support a fix to this issue, now or in the future." WHAT HORSESHIT! So all of the Windows NT 4.0 machines of the world are open doors to this (and other) attacks. Oh, they do recommend that you put it behind a firewall and block port 135. And if you happen to be using 135, well, you gotta have to recode and recompile any and all programs that do. Don't have the source code? Well, how good are you are reverse engineering. And be careful, it may be illegal were you live. AND you gotta trust everyone behind that firewall to not crack your machine!
t .asp?url=/technet/security/bulletin/ms03-010.asp):
Now, the karmaic debt in all of this - Microsoft's Windows Update will get attacked by WinNT 4.0 every month. Mmmm. So, everyone else gets fixed and the ones that MICROSOFT want you to upgrade become easily identified as problems on the net.
Sure, one P.-off muther-F. may have written this worm to get at Microsoft. Or maybe it came from somewhere in Washington state. So, what is next? All "obsolete" versions of Microsoft products get infected with worms that will install a gigabyte of child prono and then email the police? I guarantee with publicity like this, evildoers will be using WinNT as a platform for all kind of crap for now on. Thanks a lot, Microsoft, the Crackers Best Friend!
Here's the Microsoft spin on this from the FAQ in Microsoft Security Bulletin MS03-010 (http://www.microsoft.com/technet/treeview/defaul
"If Windows NT 4.0 is listed as an affected product, why is Microsoft not issuing a patch for it?"
"During the development of Windows 2000, significant enhancements were made to the underlying architecture of RPC. In some areas these changes involved making fundamental changes to the way the RPC server software was built. The Windows NT 4.0 architecture is much less robust than the more recent Windows 2000 architecture, Due to these fundamental differences between Windows NT 4.0 and Windows 2000 and its successors, it is infeasible to rebuild the software for Windows NT 4.0 to eliminate the vulnerability. To do so would require rearchitecting a very significant amount of the Windows NT 4.0 operating system, and not just the RPC component affected. The product of such a rearchitecture effort would be sufficiently incompatible with Windows NT 4.0 that there would be no assurance that applications designed to run on Windows NT 4.0 would continue to operate on the patched system."
"Microsoft strongly recommends that customers still using Windows NT 4.0 protect those systems by placing them behind a firewall which is filtering traffic on Port 135. Such a firewall will block attacks attempting to exploit this vulnerability, as discussed in the workarounds section below."
"Will Microsoft issue a patch for Windows NT 4.0 sometime in the future?"
"Microsoft has extensively investigated an engineering solution for NT 4.0 and found that the Windows NT 4.0 architecture will not support a fix to this issue, now or in the future."
The moral is upgrade. Upgrade and get people like Microsoft who abandon you out of your life. Upgrade to Linux.
A new version of Blaster has started spreading. The new version is called RPCsdbot.A by Trend Micro and appears to be more stable and can also open a backdoor to IRC.
RPCsdbot.A Information
Beware: In C++, your friends can see your privates!
So i got the timer,
i got the reboot,
i scaned with the program..
no virus..
Is it posible the 'error' and timer
can be from just a random problem??
or have i got some undetecable varent?
You have 5 Moderator Points!
Which Helpless Linux zealot/MS basher do you want to mod down today?
I wonder when someone will release a virus for an exploit that they just found, one that they didn't tell Microsoft about. If they found one for IIS it would basically kill the entire windows internet (since you couldn't just firewall off the port).
And of course the same thing could happen with Linux. There have been security holes in Apache and especially in various distros.
I guess we're lucky that people finding holes so far have been benign. (or at least more interested in having access then causing chaos...)
autopr0n is like, down and stuff.
The only real solution in this case is a good firewall and keeping up with the endless stream of security patches; unfortunately, Microsoft in their infinite wisdom have decided that users can't turn off RPC's network functionality. While turning off services you don't need is good security practice, there are some exploitable services that the system needs and you can't just turn off. RPC falls into this category, and you can't do much besides firewall and patch it.
That's it. I'm no longer part of Team Sanity.
Windows: all-your-base-ar[Rebooting in 60 seconds]
Now go and average that out over a year. Bear in mind that MS-Windows exploits are being reported on a small software set (OS, email client, database, web server, web browser, email client) and Linux exploits are being reported on any of 4000 (Mandrake) - 8000 (Debian) packages, most of which will not be installed on your typical desktop or server. Estimate a percentage installed on each and discount appropriately.
Now assign a severity rating, maybe base=25% remote=50% privesc/root/admin/ring0=25% to each incident and see how they compare.
And so on. No sense comparing an overdecorated Niva with a Land Cruiser and complaining about the mileage, either.
Got time? Spend some of it coding or testing
Since the shutdown tends to occur the moment you access the internet, do the following;
1. Unplug internet connection
2. Enable Win XP firewall on all valid connections
3. Connect internet connection
4. Download and install the patch from MS
5. Update anti-virus or download and run the removal tool
Good Luck!
Proverbs 16:18 "Pride goeth before destruction, and an haughty spirit before a fall"
If Linux has as many security problems as Windows I really doubt you can name too many of them since you're not even aware of general facts.
Reformatting, reinstalling, and patching in the long run will save time versus trying to find needles in the haystack of which files were modified, deleted, or otherwise compromised if you were hit by this RPC exploit. Weeks later you'd be hunting around for incorrect files or would have IRC bots screwing you up. Penny wise, pound foolish.
Just got this from the Abilene (Internet 2) Operations Center. Apparently this is significantlyi affecting at least the .edu side of the network:
- 2003-0352
Abilene Connectors and Participants,
As you're all probably painfully aware by now, a worm exploit of the Microsoft
DCOM RPC vulnerability, W32/Blaster, was unleased on Monday August 11. Details
regarding the vulnerability and exploit can be found at the references provided
below.
Worm traffic on Abilene is very high, peaking at 7%+ of all packets on the
network. We're performing an analysis of Abilene netflow data, and early this
afternoon will provide a private communication to sites that are sourcing a
large amount of worm traffic.
Recommendations for network border filtering are included the CERT W32/Blaster
advisory, http://www.cert.org/advisories/CA-2003-20.html. Filters should be
defined as input and output - to protect yourselves and to protect from
infecting others.
Abilene Connectors, please pass this communication on to your Participants.
References:
Microsoft DCOM RPC:
http://www.cert.org/advisories/CA-2003-16.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN
W32/Blaster:
http://www.cert.org/advisories/CA-2003-20.html
Regards,
XXXX XXXXXXX
Director, REN-ISAC
for analysis here
Also some cool screenshots of the beast in action here, and here
Which makes me wonder if this was the only way for the writer to contact SAN. Perhaps she had moved to another country or disconnected her phone and the only thing Jackass McWormerson could think of was communicating through a computer virus.
I have about 1000+ locations that are having trouble opening Excel documents and can no longer disconnect fromt the internet. Also in Inotes and Outlook they cannot OPEN individual emails (This is intermittent). Could these also be related to Blaster or are we looking at a different virus.
-=[ Who Is John Galt? ]=-
Don't worry I know your problem.. You put the wrong boot disk in.. The one you want is the CD that says LINUX not Microsoft Windows XP. If that doesnt work.. Open up you case and find the worm.. They are a brownish colour some are a couple inches long.. good luck!
I helped a friend remove this virus yesterday. Here is what we did:
w s\Curr entVersion\Run\windows auto update
1: Enable Internet Connection Firewall (for once, it actually has a use!)
2: Download and install MS03-026
3: Remove the following registry key:
HKey_Local_Machine\SOFTWARE\Microsoft\Windo
4: search for and remove all files beginning with msblast.exe
Turns out aside from DDOS'ing Microsoft, this worm is pretty harmless.
LedgerSMB: Open source Accounting/ERP
Don't worry I know your problem.. You put the wrong boot disk in.. The one you want is the CD that says LINUX not Microsoft Windows XP. If that doesnt work.. Open up you case and find the worm.. They are a brownish colour some are a couple inches long.. good luck!
/. all you hear is LINUX LINUX LINUX. All over CNET and TechTV all you hear is LINUX LINUX LINUX.
Screw you guys and your Monopoly. I'm switching to Windows, The Alternative OS.
Hell no. All over
do() || do_not();
http://www.linuxiso.com/p p/2680 :-)
http://www.bebits.com/a
http://www.qnx.com/
Let it spread freely! On August 16 I'll be trying to run it under Wine to see if I can be of some help.
- Please, ignore everything written above.
Whoops.. Radio just reported that anyone who has a license expiring today has a 1-day extension. Thanks, Bill.
No. Windows ME isn't either.
Win95, 98, 98SE, and ME are all based off of the same codebase. All are unaffected.
WinNT, Win2k, WinXP, and Win2k3 are all based off of the same codebase. All unpatched machines are targets.
as of late last night, which is when the large number of port 135 hits to my Linux server abruptly stopped. Good for Comcast!
Our university has just shut out all traffic from outside the system. That's almost as good as a DoS.
Bob McKenzie: Fleshy headed mutant, are you friendly?
Doug McKenzie (As the fleshy headed mutant): No way, eh! Ra-radiation has made me an enemy of civilization!
after you know you're infected, boot into windows. disable dcom via dcomcnfg -> components -> computers -> my computer properties. reboot into windows and use stinger or some other tool to get rid of the worm...then download the windows patches. if you need DCOM, turn it on. most users won't.
-Lucas
Here is a nice command line utility to scan your network for vulnerable machines. It gives you a neat list of patched and compromisable computers.
- 026rpc.php
http://www.iss.net/support/product_utilities/ms03
Actually, it's possible to close all ports in windows, but it's harder than it should be. Just close all those services that nobody needs and run dcomcnfg.exe and remove all remote DCOM/COM+/whatever support. If you know that you need those, you obviously shouldn't do this. But if you know that you need those protocols, you probably work for Microsoft anyway. Dinkumware's fport helps you to find out which programs keep all those ports open.
Yes, the default settings from redmond are brain-dead at best - what else is new?
I don't run a firewall on my windows workstation but on the other hand it doesn't have any ports open, other than those opened by Mozilla to browse the web and those opened by miranda. Having a firewall doesn't help with those ports. Obviously, running a firewall could help catching software that's trying to call home, but I don't run every random piece of software I can get my hands on. If somebody can still crash a windows that doesn't have a single port open, you're fucked anyway.
_________________________
Spelling and grammar mistakes left as an exercise for the reader.
I think Microsoft should be required to put a notice on the box, saying "Using Windows XP for Internet access requires a broadband connection". If you've got dialup, there's just no way you're going to be downloading those 50MB service packs, and if you're not downloading them, you're a menace to the rest of the net.
(Or at least, the rest of the net that's dumb enough to run Windows.)
GCHQ Quantum Insert installed. If only our tongues were made of glass, how much more careful we would be when we speak
I found out about the worm on Monday, approximately 2PM PST. Did not hear any news regarding this on any of the big TV networks UNTIL 6AM (PST) the following morning.
Rather than simply just users being clueless, there's a large number of users being kept clueless by the news media. Assuming that 100,000 users would catch an early (eg; 2-3 hours after worm insertion) report on CNN, for example, then you would have at least 75,000-90,000 who could have patched their systems.
But instead, the worm was given close to 20 hours to spread amongst that 100,000 users, who, not being average readers of Slashdot or what have you, never patched their systems, even up til now.
Hell, according to a friend who works within the bowels of IBM, their R&D departments and related servers caught the worm, and everyone's scrambling like mad to fix it.
So who, other than Microsoft (who did put a patch for just such an exploit) is to blame?
(1) The author of the worm, naturally.
(2) The news media, for failing to bring this to the public's attention (yeah, covering Arnold Schwartzenegger's political relevance is SO much more important than keeping people in the other 49 states informed)
(3) Windows users, who, despite the patch being available for a month, and the security warnings for longer, still refused to install the nessesary patches.
(4) The usual braying "Hurh hurh, Windoze users are dummies!" linux zealots. Preferring to bask in their self proscribed superiority, rather than work to change the philosophy (*) that led to the worm's creation (it takes a philosophy to justify any sociopathic behavior).
*To use the tired car analogy, if one doesn't like Ford vehicles, does that give them the right to run around slashing the tires of, or cutting the brake lines of every Ford they see on the street (in hopes that Ford will be driven out of business for faulty brake lines)? And yet, that is what the worm and virus authors want to do. It ain't about improving Windows or changing the laws, it's about trying to topple Microsoft and ruining as many of their user's computers as possible.
Just because you can mod me down, doesn't mean you're right. Shoes for industry!
Security experts have been saying for years that the security of the Windows family of products is hopelessly inadequate. Now there is a rigorous government certification confirming this.
(Originally taken from rec.humor.funny).
"Prepare for the worst - hope for the best."
IPC is more a problem with multiple solutions than an implementation; RCP, shared memory, BSD sockets, pipe links, and other IPC implementations are used based on what is best for the specific application.
That's it. I'm no longer part of Team Sanity.
Yes, it does work quite well with wine, as confirmed by tcpdump. I will be sure to have it running this weekend just in case the rumors are true. I mean, sure I could just reverser engineer it, but that's just not as fun as running it an entire weekend and watching all the ip's of recently infected users go by in my tcpdump output. BTW, Anyone in the 85.221.22.* ip block running an unpatched NT derivative, sorry, but I had to test it.