Slashdot Mirror
Botnet Herders Attack MS06-040 Worm Hole
Laljeetji writes "eweek reports that the first wave of malicious attacks against the MS06-040 vulnerability is underway, using malware that hijacks unpatched Windows machines for use in IRC-controlled botnets. The attacks, which started late Aug. 12, use a variant of a backdoor Trojan that installs itself on a system, modifies security settings, connects to a remote IRC (Internet Relay Chat) server and starts listening for commands from a remote hacker. On the MSRC blog, Microsoft is calling it a very small, targeted attack that does not (yet?) have an auto-spreading mechanism. LURHQ has a detailed analysis of the backdoor."
Could be right out of a voyager episode or something.
I really hope they reverse their shield polarity when attackign that wormhole, or it could trigger a tachyon cascade....
HI O WISE PRINCE. WHT TOOK U SO DAM LONG?
from the analysis:
This variant of mocbot copies itself to the system directory as wgareg.exe, and creates an NT service to run at startup called "Windows Genuine Advantage Registration Service". The description given to the service reads "Ensures that your copy of Microsoft Windows is genuine and registered. Stopping or disabling this service will result in system instability.", in an attempt to discourage users from stopping it from running.
Do we actually know which is the more malicious variant?
liqbase
They know where its coming from, but the Chinese are still pissed at Jack Bauer so they won't shut it down.
actually, they say its the same server thats been running for months:
Amazingly, this new variant of Mocbot, still uses the same IRC server hostnames as a command-and-control mechanism after all these months. This may be partially due to the low-profile it has held, but also may be due to the fact that the hostnames and ip addresses associated with the command-and-control servers are almost all located in China. Historically Chinese ISPs and government entities have been less-than-cooperative in taking action against malware hosted and controlled from within their networks.
liqbase
How are the IRC channel and the hacker's IP address related? Just because somebody visits some random IRC channel doesn't make them the bot author. Security researchers, for example, will also be found there.
Also, most bot herdes are in eastern europe, brazil, or developing countries. Catching hackers isn't high on the list of law enforcement priorities in the countries (and, if the right amount has been paid to the right people, it's completely ignored).
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
Notice: This worm cannot target Server 2003 or XP SP2, in fact, no exploit for them has been found. The basic flaw exists, but the stack guards used on all newer versions of Windows (post-security-push) trips all as of yet attempted attacks. To be really safe however make sure you update Server 2003 and XP SP2 machines anyway!
Find a way to make the average user patch software.
As wonderful as it would be if all software was completely bug free and contained no security holes, it's simply impossible. No product, be it OSS or commercial, is free of these banes. On the other hand, problems like this would nearly go away, if only users would patch the software. Whether it's a new exploit in Windows or Apache or phpBB, if you don't patch, you're going to get screwed. Yes, it seems like Microsoft products have more patches than average, but at least they have patches. Blaster and MyDoom? They'd have never hit the news if users were patched. Automatic Updates in XP is a great step forward, but it's still opt-in.
Some people seem amazed when I say I had no direct problems with Blaster or Welchia, and they don't seem to get it that these problems essentially always appear after a patch is release which means there is no valid reason for their survival. Patch, patch, patch, patch, patch. Yes, slightly monotonous, but if users would simple do it, we'd stop seeing these equally monotonous news stories about Exploits of Doom.
"What do you despise? By this are you truly known." --Princess Irulan, Manual of Muad'Dib
/)
Modern botnet command-and-control IRC servers don't give out information like who else is connected. In this Mocbot C&C, you join the channel, get an encrypted command (in the channel topic) which tells the bot to join another channel. In that channel, another encrypted command in the topic tells the bot to download and execute a trojan (which currently is detected by some AV as Trojan-Proxy.Win32.Ranky.fv).
The reason for all this subterfuge is, if the AV companies aren't spying on the control channel, they have no way to know about the second-stage infection, unless they get lucky - so even if they do clean the Mocbot infection, the proxy trojan still resides on the machine.
...to think some of this stuff is officially sanctioned, state sponsored or at least allowed to continue?
It would almost as stupid for a company to deploy patches without testing them as it would be to never patch at all.
So there will be a delay between a patch being released and that patch being deployed on production systems.
And going into "crisis mode" for 2 weeks, starting the second Tuesday of every month is a bit much to expect of people.
Does that mean that if someone reverse-engineers the bot command set, maybe we can send them all a command to shutdown the service?
I don't know the meaning of the word 'don't' - J
Suppose the bots all used AIM or MSN Messenger servers. Would you demand that those be taken down?
The weak point is not IRC or any other communications method. The weak point is software that's so easy to exploit it has new "critical" patches every month [insert tampon jokes here].
Friends don't help friends install M$ junk.
Actually it's a PC who is running Windows with open Microsoft Networking ports open while connected to the Internet. Big difference. There are many holes over the years that have been exposed with the NT LAN Manager networking stack that have led to these ports being blocked at the firewall as standard practice. Going back to 1997 from what I recall someone could open up an anonymous IPC$ pipe with an NT box and create their own admin account. Things have improved since then, but anyone who has these ports up and listening on the Internet is an idiot. Back in 2000 my company got its first DSL router for Internet acccess. Even that hardware came with an option just called "Microsoft Networking" blocks. Of course patch your boxes. Keep them updated. This would avoid some local host getting something propagated through your LAN/WAN. But as for the Internet aspect, God knows people should have learned. Ports 137, 138, 139, and 445 should be nowhere to be found from the Internet!
Any updating system that requires users to type in commands, especially any commands not written in plain English ("Patch my computer.[return]"), will fail miserably among the mainstream users. Let's face facts here - Windows Update is *easier* than that. Safer? No. Forces EULA changes? Yep. But it's automatic and requires absolutely NO thinking on the part of the end-user. An update system that requires the user to do pretty much anything besides clicking 'OK' at the automatic installation prompt isn't going to work.
We need a best of both worlds solution here. Windows Update is an excellent concept. But the execution sucks for the reasons you specified - EULA changes, WGA, poor/untested/damaging patches. It needs work. But in the long run, it'll be a lot more successful and helpful than any apt-get command, or anything else that's not entirely automatic beyond authorizing changes.
How are sites slashdotted when nobody reads TFAs?