WormRadar Node Volunteers Help Graph Attacks

zoombat writes "NTBugtraq has a post looking for volunteers to run WormRadar nodes. The nodes are essentially honeypots that watch for suspicious activity. Its purpose is to both measure the frequency of known, current worms and to alert us all when something new becomes active. A graph (updated every 30 minutes) shows what was detected. Currently it looks like only a Windows client is available, though."

Comments

Other platforms

[BWJones]

Currently it looks like only a Windows client is available, though."

Might it make more sense to have the client available on platforms which are not necessarily vulnerable to most of these infections? After all, many of the systems which are connected to the Internet full time (servers/workstations etc...) are not Windows machines.

Re:Other platforms

[Raunch]

From The Jargon File

honey pot: n.
1. A box designed to attract crackers so that they can be observed in action. It is usually well isolated from the rest of the network, but has extensive logging (usually network layer, on a different machine). Different from an iron box in that its purpose is to attract, not merely observe. Sometimes, it is also a defensive network security tactic -- you set up an easy-to-crack box so that your real servers don't get messed with. The concept was presented in Cheswick & Bellovin's book Firewalls and Internet Security.
2. A mail server that acts as an open relay when a single message is attempted to send through it, but discards or diverts for examination messages that are detected to be part of a spam run.

With emphasis on the attract part. How are you going to monitor worms that propigate using windows with a linux box? You may be able to say, for instance, how many times a certain port was probed. You can't get a linux box to respond in the same way as a windows box without seriously getting into the kernel though.

Lol. Understatement.

[SatanicPuppy]

Why would you need a worm activity detecting program on a Windows box? If there's a lot of worm activity that is close enough that the windows box could monitor it, you'll know.

It's like the canary in the mineshaft...Works fine for detecting hazards, but a little rough on the bird.

Re:Lol. Understatement.

[laugau]

The REASON there is only a windows client is because the windows client does this:

while (not_infected) {
send ("Woo Hoo! I'm alive still") ;
}

And the server does this:

listen (client_port) {
while (get_alive_messages) {
writeGraph (noWorm);
}
ohShit(clientMachineGotWorm);
}

Not a very good solution if the clients never die now, is it?

Seems like a good idea implemented poorly

[Anonymous Coward]

The website is scarce on details, but from the looks of it, it would appear to not be very sophisticated. It detects very few actual worms and exploits, and would seem to be just like http://isc.incidents.org/ (Internet Storm Centre), except without nearly so much data.

Leusent _AT_ Link-net.org

Graph shows u137unk exploit

[Dark Lord Seth]

And, as it says in the article, u137unk is aimed at port 137 using UDP. NetBIOS request en masse. Over the internet? Why does this not make sense? Maybe all those exploits are Messenger spams? However, iirc, Messenger spam uses a different port and TCP. So if this is not Messenger spam... Then what?

A little creepy ... calling home?

[digitalgimpus]

Each time I launched the app, norton fires up because an email is being sent.

no mention of what anywhere.

Sorry, perhaps I'm paranoid... but that's not very cool with me.

Re:IINAL

[Anonymous Coward]

I thought honeypotting is being considerd as not-so-legal.

Why would you say that? It certainly isn't entrapment. If you leave your house windows open, it doesn't give thieves permission to steal.

And a burglar can't complain that you have video cameras all over the house recording them while you call the cops.

In Texas & many other states, you could blow them away with a shotgun and get cheers in the local paper.

For Those of you worried WR might be a Trojan

[Gadi Evron]

The author of WR is Roger Thompson, a well respected AV professional since the very first days in the late 80's/early 90's.

He is also a CARO member, which is a very respectable organization for old-timer AV researchers.

I know him personally and vouch for him, much like pretty much any other AV researcher in the world. Everybody knows Roger.

everything is explained in the NTBUGTRAQ post,

[Gadi Evron]

Hi Russ,

I am looking for some more folks who would be interested in running
WormRadar. ( http://wormradar.com). The web site is still rudimentary, but
the graph is generated every 30 minutes, and is interesting to watch, and
WormRadar.exe is available for download from there.

It is essentially a distributed Windows honeypot that listens on known
wormy ports (or ports that are likely to become wormy), and crcs, or scans,
anything that comes along. Its purpose is to both measure the frequency of
known, current worms and to alert us all when something new becomes active.
It is free provided you allow it to report to the central site.

If you allow it, WormRadar will synchronize your pc to network time, and
all events are recorded to the millisecond utc. Events are reported by both
email and udp... email because it makes it convenient to attach a capture
if it is something new, and udp because while unreliable, it is fast.

A summarized graph of activity is refreshed every 30 minutes to the
website, and is refreshed every 15 minutes on the WorldView tab within
WorldRadar itself. The WorldView tab also has notification options which
allow you to be alerted by a variety of means if something new appears,
such as email to a pager or by playing a wav file. In the fullness of time,
I'll add more views and graphs. The summary graph is interpreted like this...

(1) Green bars are recognized things
(2) Red bars are new (and should be watched)
(3) If I didn't get any data, I generate a name based on whether it was tcp
or udp, plus the port number, plus '0 bytes'.E.g. "t17300 0 bytes" means it
was TCP port 17300 and was 0 bytes long.
(4) If I got some data, but couldn't recognize it, I generate a similar
filename, but the suffix is 'unk', for unknown.
(5) I call it a 'summary', because if a single sourceip hits a single
targetip 200 times on the same port (such as a sql dictionary attack on
1433), it is really only one incident, and that is how I summarize it.

It emulates some common servers, such as web and ftp, and some common
backdoors, such as sub7 and kuang, and there are a bunch of tcp and udp
ports that can be set to whatever you like.

To install it, simply make a directory, copy it in, run it, configure it a
bit if you want, and tell it to listen. You can set it to cc yourself, and
you will receive a copy of the email sent to wormradar.com. The UDP
messages are content-identical to the email, although without email-y
things like headers, and I don't UDP the attachment if there is one.

It runs on about any Windows platform but runs best on Win ME, W2k or
WinXP. Win ME is a good platform, because there are fewer services to turn
off to allow WormRadar to listen on those ports. It runs nicely behind
firewalls like ZoneAlarm, and runs nicely in Virtual PC or VMWare. It
doesn't need much hardware... 200 or 300 mhz is fine. In the unlikely event
that you want to install it on more than one computer, please don't install
them on side by side IP addresses... this just skews the data. What we
really want is a nice, random, widespread distribution.

Thanks

Roger