August 2003 - Test - lists.nanog.org

RE: RPC errors
by McBurnett, Jim 11 Aug '03

11 Aug '03

over 24 hours.. started block suday afternoon... deny tcp any any eq 445 log (256936 matches) deny udp any any eq 445 log (1 match) deny tcp any any eq 135 (6984433 matches) deny udp any any eq 135 (147654 matches) deny udp any any eq netbios-ss deny tcp any any eq 139 log (378289 matches) -----Original Message----- From: John Palmer [mailto:nanog@adns.net] Sent: Monday, August 11, 2003 8:28 PM To: nanog(a)merit.edu Subject: Re: RPC errors 45 seconds: deny tcp any any eq 135 (5445 matches) deny tcp any any eq 137 deny tcp any any eq 138 deny tcp any any eq 139 deny tcp any any eq 445 (207 matches) ----- Original Message ----- From: "Randy Bush" <randy(a)psg.com> To: <nanog(a)merit.edu> Sent: Monday, August 11, 2003 18:52 Subject: Re: RPC errors > > must be fun out there on the net today. one minute of counter > accumulation > > deny tcp any any eq 135 (5721 matches) > deny tcp any any eq 137 > deny tcp any any eq 138 > deny tcp any any eq 139 (17 matches) > deny tcp any any eq 445 (1137 matches) > > randy > > >

1 0

Latest analysis of MSBLAST
by Huopio Kauto 11 Aug '03

11 Aug '03

from F-Secure is here: http://www.f-secure.com/v-descs/msblast.shtml --Kauto Kauto Huopio - kauto.huopio(a)ficora.fi Information Security Adviser / CERT-FI -coordinator Finnish Communications Regulatory Authority / CERT-FI tel. +358-9-6966772, fax. +358-9-6966515 CERT-FI duty desk +358-9-6966510 / http://www.cert.fi

3 2

Re: RPC errors and latest worm
by Kevin Loch 11 Aug '03

11 Aug '03

----- Original Message ----- From: Scott Fendley <scottf(a)uark.edu> Date: Monday, August 11, 2003 7:49 pm Subject: Re: RPC errors and latest worm > > " * Close port 135/tcp (and if possible 135-139, 445 and > 593) ". Is there a Windows service that uses port 136, or was it included because it's easier to type than "135, 137-139"? KL

1 0

Re: RPC errors and latest worm
by Stewart, William C (Bill), RTSLS 11 Aug '03

11 Aug '03

According to http://isc.sans.org/diary.html?date=2003-08-11 , the worm uses the latest popular MS exploit ports, so " * Close port 135/tcp (and if possible 135-139, 445 and 593) ". It also uses TCP port 4444 and TFTP = UDP 69 to download its attack code after getting the initial bootstrap infection. So you probably want to be blocking TCP 4444 and (if appropriate, which it usually is, TFTP), and tracing any 4444 activity and TFTPs to detect attacks.

2 1

RE: RPC errors
by Mike Damm 11 Aug '03

11 Aug '03

According to Symantec it doesn't know if the system has already been infected until it is running on the target machine, at which point the RPC crash is imminent. It shouldn't re-infect, but further attempts from other infected hosts will cause random reboots. On the plus side this one will be much easier to clean up than CodeRed, Nimda, etc. Random J. Clueless might actually look for patches if his box is rebooting on a regular basis. -Mike --- Michael Damm, MIS Department, Irwin Research & Development V: 509.457.5080 x298 F: 509.577.0301 E: miked(a)irwinresearch.com -----Original Message----- From: Drew Weaver [mailto:drew.weaver@thenap.com] Sent: Monday, August 11, 2003 2:53 PM To: 'Mike Damm' Cc: 'nanog(a)merit.edu' Subject: RE: RPC errors Its bloody gorgeous too, my girlfriend's pc rebooted like 9 times, apparently the worm doesn't check to see if its already infected. -----Original Message----- From: Mike Damm [mailto:MikeD@irwinresearch.com] Sent: Monday, August 11, 2003 5:27 PM To: 'Jack Bates'; NANOG Subject: RE: RPC errors The DCOM exploit that is floating around crashes the Windows RPC service when the attacker closes the connection to your system after a successful attack. Best bet is to assume any occurrence of crashing RPC services to be signs of a compromised system until proven otherwise. http://www.cert.org/advisories/CA-2003-19.html -Mike --- Michael Damm, MIS Department, Irwin Research & Development V: 509.457.5080 x298 F: 509.577.0301 E: miked(a)irwinresearch.com -----Original Message----- From: Jack Bates [mailto:jbates@brightok.net] Sent: Monday, August 11, 2003 1:12 PM To: NANOG Subject: RPC errors I'm showing signs of an RPC sweep across one of my networks that's killing some XP machines (only XP confirmed). How wide spread is this at this time. Also, does anyone know if this is just generating a DOS symptom or if I should be looking for backdoors in these client systems? -Jack

1 0

RE: RPC errors
by Brennan_Murphy＠NAI.com 11 Aug '03

11 Aug '03

does anyone know if the scanning is sequential once a range is chosen or is it random within a range? e.g., 1.1.1.1 1.1.1.2 1.1.1.3 etc or 1.1.1.89 1.1.1.33 1.1.1.12 etc -----Original Message----- From: John Dvorak [mailto:john@dvorak.net] Sent: Monday, August 11, 2003 5:57 PM To: NANOG Subject: Re: RPC errors On Mon, 11 Aug 2003 17:33:33 -0400 Kevin Houle <kjh(a)cert.org> wrote: > > --On Monday, August 11, 2003 02:26:40 PM -0700 Mike Damm > <MikeD(a)irwinresearch.com> wrote: > > >The DCOM exploit that is floating around crashes the Windows RPC > >service when the attacker closes the connection to your system after > >a successful attack. Best bet is to assume any occurrence of crashing > >RPC services to be signs of a compromised system until proven > >otherwise. > > > >http://www.cert.org/advisories/CA-2003-19.html > > That's good advice. Many of the known exploits cause the RPC service > to crash after the exploit is successful. I'll point out that not all > exploits cause the service failure. So, the absence of an RPC service > failure is likewise not an indicator that a vulnerable machine has > escaped compromise. > > Kevin Interestingly, we have clear examples of boxes which were not infected but on which RPC services did crash. This may suggest that the worm also takes advantage of the unrelated RPC DOS vulnerability (2000 and XP) which I believe MS has still not patched. John

2 1

Re: RPC errors
by John Dvorak 11 Aug '03

11 Aug '03

On Mon, 11 Aug 2003 17:33:33 -0400 Kevin Houle <kjh(a)cert.org> wrote: > > --On Monday, August 11, 2003 02:26:40 PM -0700 Mike Damm > <MikeD(a)irwinresearch.com> wrote: > > >The DCOM exploit that is floating around crashes the Windows RPC service > >when the attacker closes the connection to your system after a successful > >attack. Best bet is to assume any occurrence of crashing RPC services to > >be signs of a compromised system until proven otherwise. > > > >http://www.cert.org/advisories/CA-2003-19.html > > That's good advice. Many of the known exploits cause the RPC service > to crash after the exploit is successful. I'll point out that not all > exploits cause the service failure. So, the absence of an RPC service > failure is likewise not an indicator that a vulnerable machine has > escaped compromise. > > Kevin Interestingly, we have clear examples of boxes which were not infected but on which RPC services did crash. This may suggest that the worm also takes advantage of the unrelated RPC DOS vulnerability (2000 and XP) which I believe MS has still not patched. John

3 2

RE: RPC errors
by Drew Weaver 11 Aug '03

11 Aug '03

Its bloody gorgeous too, my girlfriend's pc rebooted like 9 times, apparently the worm doesn't check to see if its already infected. -----Original Message----- From: Mike Damm [mailto:MikeD@irwinresearch.com] Sent: Monday, August 11, 2003 5:27 PM To: 'Jack Bates'; NANOG Subject: RE: RPC errors The DCOM exploit that is floating around crashes the Windows RPC service when the attacker closes the connection to your system after a successful attack. Best bet is to assume any occurrence of crashing RPC services to be signs of a compromised system until proven otherwise. http://www.cert.org/advisories/CA-2003-19.html -Mike --- Michael Damm, MIS Department, Irwin Research & Development V: 509.457.5080 x298 F: 509.577.0301 E: miked(a)irwinresearch.com -----Original Message----- From: Jack Bates [mailto:jbates@brightok.net] Sent: Monday, August 11, 2003 1:12 PM To: NANOG Subject: RPC errors I'm showing signs of an RPC sweep across one of my networks that's killing some XP machines (only XP confirmed). How wide spread is this at this time. Also, does anyone know if this is just generating a DOS symptom or if I should be looking for backdoors in these client systems? -Jack

1 0

RE: RPC errors
by Brennan_Murphy＠NAI.com 11 Aug '03

11 Aug '03

http://vil.nai.com/vil/content/v_100547.htm -BM -----Original Message----- From: Chris Reining [mailto:creining@packetfu.org] Sent: Monday, August 11, 2003 5:36 PM To: Sean Donelan Cc: Jack Bates; NANOG Subject: Re: RPC errors On Mon, Aug 11, 2003 at 04:17:53PM -0400, Sean Donelan wrote: > On Mon, 11 Aug 2003, Jack Bates wrote: > > I'm showing signs of an RPC sweep across one of my networks that's > > killing some XP machines (only XP confirmed). How wide spread is > > this at this time. Also, does anyone know if this is just generating > > a DOS symptom or if I should be looking for backdoors in these > > client systems? > > http://isc.sans.org/diary.html?date=2003-08-11 > The worm uses the RPC DCOM vulnerability to propagate. One it finds a > vulnerable system, it will spawn a shell and use it to download the > actual worm via tftp. > > The name of the binary is msblast.exe. It is packed with UPX and will > self extract. The size of the binary is about 11kByte unpacked, and > 6kBytes > packed: I have a copy of this worm at http://www.packetfu.org/malware/msblast.zip

1 0

RE: RPC errors
by Mike Damm 11 Aug '03

11 Aug '03

The DCOM exploit that is floating around crashes the Windows RPC service when the attacker closes the connection to your system after a successful attack. Best bet is to assume any occurrence of crashing RPC services to be signs of a compromised system until proven otherwise. http://www.cert.org/advisories/CA-2003-19.html -Mike --- Michael Damm, MIS Department, Irwin Research & Development V: 509.457.5080 x298 F: 509.577.0301 E: miked(a)irwinresearch.com -----Original Message----- From: Jack Bates [mailto:jbates@brightok.net] Sent: Monday, August 11, 2003 1:12 PM To: NANOG Subject: RPC errors I'm showing signs of an RPC sweep across one of my networks that's killing some XP machines (only XP confirmed). How wide spread is this at this time. Also, does anyone know if this is just generating a DOS symptom or if I should be looking for backdoors in these client systems? -Jack

2 1