Slashdot Mirror
Lessons Learned From Blaster
CowboyRobot writes "It's been nearly a year since Blaster struck, causing hundreds of millions of dollars in fixes and lost revenue.
Jim Morrison of Symantec goes step-by-step in looking at how the Blaster worm got out of control so quickly, and what lessons can be learned from that event, by studying how one utility company dealt with it." The story is written as a fun, technothriller narrative; here's an snippet: "The laptops, usually out in the field, were always a hit-and-miss proposition to find on the network and deliver a patch or to have the user take the machine to a field office. That meant that on the 16th they could see a flood of traffic launched against Microsoft. The second phase of Blaster, launching a DoS (denial of service) attack against windowsupdate.com, was imminent."
Don't run windows. :D
Eheh, I couldn't help but chuckle when I read "Jim Morrison". Totally destroys the seriousness of the article.
All Hail Discordia. Hail Eris. Fnord.
I thought Blaster was a RPC virus, i.e. not one broacast via email? I'm sure that's the one that got me a couple of times before I installed a decent firewall (you have 5 seconds to close all work...). Bloody swine of a thing it was - I'd always seem to be winning at Counterstrike too! (Well, that was my excuse, anyway)
The main weakness that allowed ingress was that any outside machine with a VPN connection also has a real IP address as well. Those machines, since they were unpatched, were sitting ducks for the virus... and then the trusted nature of the VPN assured that the virus would spread to the inside.
A basic firewall on the deployed machine to drop any packet not from the VPN could have stopped this before it started...
Blaster didn't spread through email. It used a DCOM exploit if I remember correctly.
"It is not how things are in the world that is mystical, but that it exists." -Ludwig Wittgenstein
Back when Messenger Service popups happened and started using $80 hardware firewalls that doubled as Internet sharing boxes.
When Blaster hit I was sitting pretty and so was every client that took my advice.
*yawn*
Use Evolution instead of Outlook? Bewa
Blaster didn't require user intervention to run. Default Windows installations came with the RPC service turned on, and that was all it took to be at risk. If your machine listened on port 135, the virus had a way in.
A contractor using the guest offices brought Blaster inside. His laptop infected the security-counter image-storage system, which then found its way to the HR server. That in turn spawned the infections to the HR XP laptops where the patch failed.
The first thing you learn in ANY security job is that most breaches are from the inside.
As someone standing right behind the front lines, I will tell you that employees with laptops are the worst. Most end up with administrator access (not that hard to crack if you don't have it). And the fact that they bring their computers home and on the road makes them feel a certain entitlement to install whatever they feel like. Contractors are even worse, since most of the time these laptops ARE their personal PCs. Desktops and servers inside the DMZ are the least likely originators of malware. (Not to say you couldn't surf pr0n on the company mail server as an admin. But then you deserve what you get.)
Network admins need to lock down MAC addresses and start treating their network like the PBX folks. Nothing gets wired except approved company equipment.
Have you Meta Moderated t
If it gets really high, eg 50 or so (your average AOL user) automatically turn on the Windows Firewall, and include a flag on every outgoing packet indicating that the user cannot be trusted to operate their computer in a safe fashion. Webmasters can then block traffic from these PC's at their discretion - Problem solved.
Making the moon less necessary since 1998.
A key paragraph in the story...
"We had to do some research, but we found out that the way we locked down the users prevented the patch from running properly," lamented one of the policy admins. "What we discovered was that the software restriction policy for the local computer allowed only local computer administrators to select trusted publishers. Because our patch agent ran as a pseudo user, the agent did not have the necessary rights. This was causing the failure. We changed the group policy for the HR systems so that we can patch remotely from now on."
Sometimes, locking your system too tightly ends up locking the keys in the car. When you really need something to run, it doesn't...
http://www.giac.org/practical/GCIH/John_VanHoogstr aten_GCIH.pdf
On the one hand, virus writers are aggressively pursued and prosecuted with claimed damages of billions of dollars; on the other hand, these losses are not included in the TCO of Windows! What gives?
The conference room used for the first discussions had been converted to a war room. The whiteboards were filled with IP addresses gathered by the help desk of systems suspected of being infected and trying to propagate the worm. Another list for all of the nonfunctional pay systems covered the entire portable whiteboard. These systems would have to be patched before they could be used to receive payments again.
:)
Red Alert! All senior officers to the battle bridge. Prepare for saucer seperation in T minus 3 minutes and counting.
Picard: Data, can you locate the origin of infection?
Data: It will take aproximatly 10 minutes to scan each subnet.
Picard: We don't have that kind of time. Number One, options?
Riker: Disconnect the OC3 and raise the firewall, leave no ports open.
Captain: That should buy us some time but we need a better solution than that.
Diana: I am sensing something captain, it feels as if the SUS server has fallen offline, we may have missed the latest patches
Data: Her hypothesis could be correct
We are the Borg, We will assimilate you!
Captain: Damn, and here I was thinking it was The Boy and his nanites again
No offense Wil
Im dreaming ofa big bndwdth, That can resist the
Don't open attachments that you weren't expecting. Get a firewall. A REAL firewall, a HARDWARE firewall. It doesn't have to be expensive, just a little Linksys box or something else designed to act as a router between your PCs and your cable/xDSL modem. Keep your systems patched. Do these things and you'll be just fine.
But, it's the lowest hanging fruit that get eaten first. As long Windows is popular and there are people running the systems unpatched and doing stupid stuff like executing the newest screensaver they got in an e-mail, Windows will be THE target for viruses. OS X and Linux won't become popular targets for viruses untill they are more common, Microsoft does a better job, and the people who use them are less technical (this applies to Linux more than OS X). This paragraph is my speculation, of course.
Comment forecast: Bits of genius surrounded by a sea of mediocrity.
The Blaster Worm awoke before dawn.
He put his boots on.
The utility company lost more than $1 million in revenue that would normally have been generated from the pay systems during the time they were down.
Wait a second. Blaster didn't directly cut off any customers. How could the virus cost revenue?
Well, in the case of this story's Mona, it was because her power was cut off despite the fact she had the money to pay her bill through the last-minute pay system. That means a few days that she didn't use power, plus the cost of a needless disconnect that they couldn't charge for.
If the power company had a brain or heart, they would have not done any disconnects due to non-payment during this time frame. Sure, some deadbeats would get 3 days of free power, but the majority of people who missed their payment deadline would happily pay if just given the chance.
In short, they could have saved time and money if the bill collectors would have been told to take some time off...
There are even ATMs that run on Windows.
Blaster was a worm, and of worms in general I would say that there is little new to be learned from them. I did learn something new with blaster though.
I was doing some security work for an ISP at the time of blaster. They have a number of Cisco 12000 series GSR routers as well as Foundry Big Iron Switches. For those who are not familiar with the Cisco 12000 series routers, let it be sufficed to say that it is Cisco's biggest, baddest router that stands up to 6 feet tall and comes from the factory with a 4 barrel carburetor, dual testosterone modules and a custom paint job with flames painted on the side (pin stripes are optional). These switches are designed to handle hundreds of gigs of traffic across their backplane and through their interfaces. If the ISP were forewarned that they would be seeing 300 mbps of traffic coming from the MS Blaster worm, they would have said "Bring it on!"
For those of us that aren't CCIE's, Cisco routers and Layer 3 switches have a function called CEF, or Cisco Express Forwarding. CEF is a technology that by its simplest definition caches routes.
If a packet from my computer is destined for yahoo.com, it will first hit the DNS server to resolve the host name to its IP address. My computer will then send packets to my ISP with the destination IP of yahoo.com (66.218.71.198). My ISP's router, presuming it's a Cisco router with CEF enabled, will look at its internet BGP tables and determine the optimal route my packet should take on the internet to arrive at that destination. Once the router has processed the route, it caches it so that all future packets coming from my home IP address, destined for yahoo.com will automatically be routed using the cached route. This takes a tremendous load off the router CPU as each packet no longer needs to be processed by the CPU, hence the term "Express Forwarding".
What the blaster worm did was send out hundreds of thousands of ICMP pings per second. This usually wouldn't be a problem for the router, except for each packet was destined for a unique IP address. What started happening is that each route was looked up, routed, and stored in its cache for future packets - only there weren't any future packets. What happened next was the memory space allocated for caching CEF routes filled up, and once full, the router simply purged its cache so that every packet had to then go to the CPU to be routed. Once this happened, all hell broke loose.
CPU utilization on the routers jumped to 100%, which should never happen under normal conditions, but this was clearly not a normal condition, and the internet came to a crawl.
There we were, with a router that should handle hundreds of gigs across the backplane without breaking a sweat being brought to its knees by 100mb of traffic... it was incredible.
Good security is based upon reality and common sense. Common sense is a function of having common knowledge.
I love the little flash advertisement which is attached to this article, claiming Microsoft outperforms Linux by a factor of 276%. They must be talking about worm propagation efficiency.
It did nothing to the files, just rebooted the computer, and waited for a precise date to attack Microsoft site. I wanted to participate to this huge distributed computing effort.
To do this, no patch was required: just open the control panel, clic on ugly icons, and go to the RPC panel. Here, I was surprised to see that the main annoying comportment of this worm was due to a default windows setting!
The default option on RPC failure is to "restart computer"! So I chose the "restart service" option for every failure and that worked fine! All my friends could now live with this worm and contribute to this distributed computing effort!
Default options in Windows are users' worst choices: restart the computer on every failure!! The most funny, an stupid, one is the default restart computer on... boot failure!
To Fix every virus under Windows, put a Knoppix CD in your box and then restart your computer for the last time.
Well, there are three problems with windows update which IMO takes significant blame away from the users:
1. Microsoft's update system has been less than simple to date. Ex:
Update 00dflkjsd_9 - fixes a flaw in some obscure dll which you have no idea if you use or even have installed. Only install this update if you are having problems with some arbitrary function after installing update fskjsdf_3. ( I have no idea what update fskjsdf_3 IS, never mind if I've had trouble with it. If I install this anyway, will it cause me trouble that it was trying to fix?)
Yea, I made it up, but that's my impression of some items I've seen the few times I've had to update a windows machine. (I run OS X myself). This is compounded by MS's apparent refusal or inability to "roll up" updates in to "service packs" on a regular basis.
2. You have, until recently, been forced to launch MSIE and specifically visit WindowsUpdate to check for updates, Only MSIE works and there was no automated checking feature. To my knowledge auto-check is only available in XP. The large number of users in corporations don't have any need to upgrade from 2000, or 98/95 and don't have the auto-check feature.
3. Once you are at the site and see there are updates to install, you might have to reboot the system several times. MS is quite fond of "exclusive installers" where you can only choose the one update to install, then reboot and move on to others. From a clean install, this will usually require at least three reboots on an XP box. For a small home machine this may only take two minutes per reboot, but for self monitoring servers a reboot can take up to 10 minutes what with memory tests, system checks, RAID startup, clock syncing, etc.
The questions I have for Microsoft are:
Why can't you issue a service pack for XP already? All the patches are verified, just apply them cumulatively in a single unified installer.
Why aren't the existing patches on the new CDs and systems that people are purchasing? Surely MS has the clout to force the integrators to apply existing patches before shipping a system. There's absolutely no reasonable excuse for a brand new system from HP, Dell, or Gateway to arrive with security holes that were identified and patched two years ago.
Article X: The powers not delegated... by the Constitution...are reserved...to the people