- NANOG - lists.nanog.org

Re: RPC errors
by Steven M. Bellovin 13 Aug '03

13 Aug '03

In message <Pine.LNX.4.33.0308121243210.814-100000(a)morannon.the-infinite.org>, "Dominic J. Eidson" writes: > >On Mon, 11 Aug 2003, Jack Bates wrote: > >> Sean Donelan wrote: >> >> > http://isc.sans.org/diary.html?date=2003-08-11 >> > The worm uses the RPC DCOM vulnerability to propagate. One it finds a >> > vulnerable system, it will spawn a shell and use it to download the actual >> > worm via tftp. >> > >> > The name of the binary is msblast.exe. It is packed with UPX and will self >> > extract. The size of the binary is about 11kByte unpacked, and 6kBytes >> > packed: > >Has anyone seen/heard of this virus propagating through email in any way? > >We appear to have been infected on a network that is very heavily >firewalled from the outside, and are trying to track down possibly entry >methods the worm might have had... A large number of networks have unknown and unauthorized back doors. If it's a decent-sized network and you haven't audited it, don't assume that the firewalling is effective. (My co-author on "Firewalls and Internet Security" book, Bill Cheswick, is CTO of a startup that maps intranets for just this reason.) --Steve Bellovin, http://www.research.att.com/~smb

3 2

RE: RPC errors
by Vachon, Scott 12 Aug '03

12 Aug '03

addendum: These are broadband cable users. All PCs. -----Original Message----- Sent: Tuesday, August 12, 2003 1:57 PM To: NANOG Subject: RE: RPC errors >Has anyone seen/heard of this virus propagating through email in any way? >We appear to have been infected on a network that is very heavily >firewalled from the outside, and are trying to track down possibly entry >methods the worm might have had... I know of a few associates who have been infected (on home networks) but according to them (I have yet to verify) not via e-mail. These folks are running Windows XP Pro with Norton AV & Personal firewall. Microsoft update is running as well. Systems continuously reboot by RPC with a one minute countdown, even when disconnected from the network. Again, I have yet to get hands-on to the systems to do more research. Hope that bit helps. ~S~ Disclaimer: My own two cents. Learn more about Paymentech's payment processing services at www.paymentech.com THIS MESSAGE IS CONFIDENTIAL. This e-mail message and any attachments are proprietary and confidential information intended only for the use of the recipient(s) named above. If you are not the intended recipient, you may not print, distribute, or copy this message or any attachments. If you have received this communication in error, please notify the sender by return e-mail and delete this message and any attachments from your computer.

1 0

RPC errors
by Jack Bates 12 Aug '03

12 Aug '03

I'm showing signs of an RPC sweep across one of my networks that's killing some XP machines (only XP confirmed). How wide spread is this at this time. Also, does anyone know if this is just generating a DOS symptom or if I should be looking for backdoors in these client systems? -Jack

7 8

RE: RPC errors
by Vachon, Scott 12 Aug '03

12 Aug '03

>Has anyone seen/heard of this virus propagating through email in any way? >We appear to have been infected on a network that is very heavily >firewalled from the outside, and are trying to track down possibly entry >methods the worm might have had... I know of a few associates who have been infected (on home networks) but according to them (I have yet to verify) not via e-mail. These folks are running Windows XP Pro with Norton AV & Personal firewall. Microsoft update is running as well. Systems continuously reboot by RPC with a one minute countdown, even when disconnected from the network. Again, I have yet to get hands-on to the systems to do more research. Hope that bit helps. ~S~ Disclaimer: My own two cents. Learn more about Paymentech's payment processing services at www.paymentech.com THIS MESSAGE IS CONFIDENTIAL. This e-mail message and any attachments are proprietary and confidential information intended only for the use of the recipient(s) named above. If you are not the intended recipient, you may not print, distribute, or copy this message or any attachments. If you have received this communication in error, please notify the sender by return e-mail and delete this message and any attachments from your computer.

1 0

RE: RPC errors
by Austad, Jay 12 Aug '03

12 Aug '03

> We appear to have been infected on a network that is very heavily > firewalled from the outside, and are trying to track down > possibly entry > methods the worm might have had... VPN or dialup? Laptop user that got infected at home and brought his machine into the office? -jay

1 0

RE: Port blocking last resort in fight against virus
by Mark Segal 12 Aug '03

12 Aug '03

Well after my port blocking escapades of yesterday we have got one complaint.. Someone who was selling exchange based mailboxes. So his /26 is now a permit rule in the acl.. But the blocking, has cut down on our infection rate significantly. (I am seeing a lot of inbound, but not a lot of outbound traffic to 135). mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: McBurnett, Jim [mailto:jmcburnett@msmgmt.com] Sent: August 12, 2003 12:40 PM To: Jack Bates; Mans Nilsson Cc: nanog(a)merit.edu Subject: RE: Port blocking last resort in fight against virus Jack, et al. As a larger than average end user and what could be called a small ISP, I really can not image legitimate traffic on 135.. who in there right mind would pass NB traffic in the wild? I dunno, may it is just that Old military security mindset creeping into my brain housing group. Can someone enlighten me? What is legitimate 136 traffic? J -----Original Message----- From: Jack Bates [mailto:jbates@brightok.net] Sent: Tuesday, August 12, 2003 12:31 PM To: Mans Nilsson Cc: nanog(a)merit.edu Subject: Re: Port blocking last resort in fight against virus Mans Nilsson wrote: > > Your chosen path is a down-turning spiral of kludgey dependencies, > where a host is secure only on some nets, and some nets can't cope > with the load of all administrative filters (some routers tend to take > port-specific filters into slow-path). That way lies madness. > Secure? Who's talking about secure? I'm talking about trash. Not blocking the port with a large group of infected users means that your network sends trash to other people's networks. Those networks may or may not have capacity to mean your network's trash. Temporarily blocking 135 is not about security. A single infection within a local net will infect all vulnerable systems within that local net. A block upstream will not save local networks from cross infecting. However, it does stop your network from sending the trash out to other networks which may have smaller capacities than your network does. Of course, perhaps a good neighbor doesn't really care about other people's networks? Perhaps there is no such thing as a good neighbor. It's kill or be killed, and if those other networks can't take my user's scanning them, then tough! There is legitimate traffic on 135. All users I've talked to have been understanding in a short term block of that port. They used alternative methods. I have a lot of valid traffic still cranking out the other Microsoft ports. -Jack

1 0

MPLS Broadband Wholesale
by Jay Greenberg 12 Aug '03

12 Aug '03

Has anyone on the list had experience wholesaling Broadband Residential Internet access via an MPLS infrastructure? I'm mainly interested in how to address the vrf interfaces that face the residential customers. i.e., if this is a wholesale customer, should the end ISP supply the addressing, default gw, etc, and should DHCP or proxy arp be used? etc etc etc... you get the point (I hope).. Thanks! -- Jason Greenberg, CCIE #11021 <jg(a)execulink.com>

1 0

RE: Port blocking last resort in fight against virus
by Dave Israel 12 Aug '03

12 Aug '03

On 8/12/2003 at 12:40:19 -0400, McBurnett, Jim said: > who in there right mind would pass NB traffic in the wild? That's the problem; not all customers are in their right mind. All they know is that it was working yesterday, and not today, because you blocked a port. The question of port blocking for most sizable ISPs comes down to principle vs principle. One the one hand, you have the principle of network invisibility. You agreed to pass customer traffic, not pass judgement on it. If it's a valid IP packet, you'll deliver it. And you don't slow down or stop traffic because you're spending cycles examining packets.* That's what customers expect. On the other hand, you have the principle of being a good network citizen. You try to keep your tables clean and your peers from flapping. You accept valid routes and inform your peers when you get invalid ones, so they have a chance to fix them. You are properly embarrassed when you find a spammer on your network or your name on the CIDR report. And you don't spew other people's networks with worm traffic. That is what other providers expect. Port blocking is therefore a quandry: do you stick with your customer principle, or your provider principle? I think most of us weigh the damage of the attack vs the damage of losing the port, and make individual judgement calls. It would be nice if there were some central consensus on when to block ports; then individual providers wouldn't need to take abuse from customers or other networks when their judgement wasn't exactly the same as somebody else's. -Dave * Before the holy war starts, yeah, some hardware doesn't slow down when blocking ports, and this is only an issue if your hardware isn't that breed. My point is that this might be an issue for some hardware, and that "Buy vendor X" isn't really a solution for everyone.

2 1

RE: RPC errors
by Mark Segal 12 Aug '03

12 Aug '03

I just put an access list on one of our cores with some spare cpu cycles.. And 10% of the traffic looks like port 135 calls..... Anyone else see this? Did I break anything legitimate? Also I still some Slammer traffic.. Mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: Mike Damm [mailto:MikeD@irwinresearch.com] Sent: August 11, 2003 6:19 PM To: 'Drew Weaver' Cc: 'nanog(a)merit.edu' Subject: RE: RPC errors According to Symantec it doesn't know if the system has already been infected until it is running on the target machine, at which point the RPC crash is imminent. It shouldn't re-infect, but further attempts from other infected hosts will cause random reboots. On the plus side this one will be much easier to clean up than CodeRed, Nimda, etc. Random J. Clueless might actually look for patches if his box is rebooting on a regular basis. -Mike --- Michael Damm, MIS Department, Irwin Research & Development V: 509.457.5080 x298 F: 509.577.0301 E: miked(a)irwinresearch.com -----Original Message----- From: Drew Weaver [mailto:drew.weaver@thenap.com] Sent: Monday, August 11, 2003 2:53 PM To: 'Mike Damm' Cc: 'nanog(a)merit.edu' Subject: RE: RPC errors Its bloody gorgeous too, my girlfriend's pc rebooted like 9 times, apparently the worm doesn't check to see if its already infected. -----Original Message----- From: Mike Damm [mailto:MikeD@irwinresearch.com] Sent: Monday, August 11, 2003 5:27 PM To: 'Jack Bates'; NANOG Subject: RE: RPC errors The DCOM exploit that is floating around crashes the Windows RPC service when the attacker closes the connection to your system after a successful attack. Best bet is to assume any occurrence of crashing RPC services to be signs of a compromised system until proven otherwise. http://www.cert.org/advisories/CA-2003-19.html -Mike --- Michael Damm, MIS Department, Irwin Research & Development V: 509.457.5080 x298 F: 509.577.0301 E: miked(a)irwinresearch.com -----Original Message----- From: Jack Bates [mailto:jbates@brightok.net] Sent: Monday, August 11, 2003 1:12 PM To: NANOG Subject: RPC errors I'm showing signs of an RPC sweep across one of my networks that's killing some XP machines (only XP confirmed). How wide spread is this at this time. Also, does anyone know if this is just generating a DOS symptom or if I should be looking for backdoors in these client systems? -Jack

5 5

Packeteer stuff?
by Drew Weaver 12 Aug '03

12 Aug '03

Specifically talking about the PacketSeeker 6500 Is it worth the money? Or are there better ways to get centralized views of network metrics? -Drew

1 0