I'm showing signs of an RPC sweep across one of my networks that's killing some XP machines (only XP confirmed). How wide spread is this at this time. Also, does anyone know if this is just generating a DOS symptom or if I should be looking for backdoors in these client systems? -Jack
The following came through dshield which warns about new worm: --- To: dshieldannounce@dshield.org Subject: [Dshieldannounce] likely RPC worm captured. Moving to infocon 'yellow' We received a copy of a binary that very much looks like an RPC worm. Preliminary info: - scans for port 135 as soon as it starts point) more details will be posted at http://isc.sans.org as they become available. Please submit code captures and the like to 'handlers@sans.org' -- SANS - Internet Storm Center http://isc.sans.org On Mon, 11 Aug 2003, Jack Bates wrote:
I'm showing signs of an RPC sweep across one of my networks that's killing some XP machines (only XP confirmed). How wide spread is this at this time. Also, does anyone know if this is just generating a DOS symptom or if I should be looking for backdoors in these client systems?
-Jack
On Mon, 11 Aug 2003, Jack Bates wrote:
I'm showing signs of an RPC sweep across one of my networks that's killing some XP machines (only XP confirmed). How wide spread is this at this time. Also, does anyone know if this is just generating a DOS symptom or if I should be looking for backdoors in these client systems?
http://isc.sans.org/diary.html?date=2003-08-11 The worm uses the RPC DCOM vulnerability to propagate. One it finds a vulnerable system, it will spawn a shell and use it to download the actual worm via tftp. The name of the binary is msblast.exe. It is packed with UPX and will self extract. The size of the binary is about 11kByte unpacked, and 6kBytes packed:
Sean Donelan wrote:
http://isc.sans.org/diary.html?date=2003-08-11 The worm uses the RPC DCOM vulnerability to propagate. One it finds a vulnerable system, it will spawn a shell and use it to download the actual worm via tftp.
The name of the binary is msblast.exe. It is packed with UPX and will self extract. The size of the binary is about 11kByte unpacked, and 6kBytes packed:
That shows what I'm seeing. 10% of all outbound packets are tcp/135. Currently blocked both directions at edges in my network until further notice. Keeping an eye on other ports, but this is the only one causing any amount of load to draw concern. -Jack
On Mon, 11 Aug 2003, Jack Bates wrote:
Sean Donelan wrote:
http://isc.sans.org/diary.html?date=2003-08-11 The worm uses the RPC DCOM vulnerability to propagate. One it finds a vulnerable system, it will spawn a shell and use it to download the actual worm via tftp.
The name of the binary is msblast.exe. It is packed with UPX and will self extract. The size of the binary is about 11kByte unpacked, and 6kBytes packed:
Has anyone seen/heard of this virus propagating through email in any way? We appear to have been infected on a network that is very heavily firewalled from the outside, and are trying to track down possibly entry methods the worm might have had... - d. -- Dominic J. Eidson "Baruk Khazad! Khazad ai-menu!" - Gimli ------------------------------------------------------------------------------- http://www.the-infinite.org/ http://www.the-infinite.org/~dominic/
"Dominic J. Eidson" wrote:
On Mon, 11 Aug 2003, Jack Bates wrote:
Sean Donelan wrote:
http://isc.sans.org/diary.html?date=2003-08-11 The worm uses the RPC DCOM vulnerability to propagate. One it finds a vulnerable system, it will spawn a shell and use it to download the actual worm via tftp.
The name of the binary is msblast.exe. It is packed with UPX and will self extract. The size of the binary is about 11kByte unpacked, and 6kBytes packed:
Has anyone seen/heard of this virus propagating through email in any way?
We appear to have been infected on a network that is very heavily firewalled from the outside, and are trying to track down possibly entry methods the worm might have had...
Haven't heard of that. Dial-up? VPN? Notebook that goes home at night or on the road, attaches to Internet or other hostile network, then comes in and connects up to your network the next business day? -- Crist J. Clark crist.clark@globalstar.com Globalstar Communications (408) 933-4387 The information contained in this e-mail message is confidential, intended only for the use of the individual or entity named above. If the reader of this e-mail is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any review, dissemination, distribution or copying of this communication is strictly prohibited. If you have received this e-mail in error, please contact postmaster@globalstar.com
On Tue, 12 Aug 2003, Dominic J. Eidson wrote:
Has anyone seen/heard of this virus propagating through email in any way?
Thank you for all the responses, being in the middle of the fray fried my brain a fair bit. Possible vectors described so far: VPN, dialup, roving laptops - all of which it could have been. Again, thank you all. - d. -- Dominic J. Eidson "Baruk Khazad! Khazad ai-menu!" - Gimli ------------------------------------------------------------------------------- http://www.the-infinite.org/ http://www.the-infinite.org/~dominic/
On Mon, Aug 11, 2003 at 04:17:53PM -0400, Sean Donelan wrote:
On Mon, 11 Aug 2003, Jack Bates wrote:
I'm showing signs of an RPC sweep across one of my networks that's killing some XP machines (only XP confirmed). How wide spread is this at this time. Also, does anyone know if this is just generating a DOS symptom or if I should be looking for backdoors in these client systems?
http://isc.sans.org/diary.html?date=2003-08-11 The worm uses the RPC DCOM vulnerability to propagate. One it finds a vulnerable system, it will spawn a shell and use it to download the actual worm via tftp.
The name of the binary is msblast.exe. It is packed with UPX and will self extract. The size of the binary is about 11kByte unpacked, and 6kBytes packed:
I have a copy of this worm at http://www.packetfu.org/malware/msblast.zip
I left an 2k box open last night without firewall. 1 Hour following boot time it was hit and manifested the svchost crashing. I haven't had a chance to dig deeper to see if any sort of infection is involved but I'm leaning towards DOS. /micah ----- Original Message ----- From: "Jack Bates" <jbates@brightok.net> To: "NANOG" <nanog@merit.edu> Sent: Monday, August 11, 2003 1:12 PM Subject: RPC errors
I'm showing signs of an RPC sweep across one of my networks that's killing some XP machines (only XP confirmed). How wide spread is this at this time. Also, does anyone know if this is just generating a DOS symptom or if I should be looking for backdoors in these client systems?
-Jack
participants (7)
-
/m -
Chris Reining -
Crist Clark -
Dominic J. Eidson -
Jack Bates -
Sean Donelan -
william＠elan.net