Chris Mosby at myITforum.com

SANS - Internet Storm Center - Cooperative Cyber Threat Monitor And Alert System - Current Infosec News and Analysis

Donations for Katrina victims - be careful

We decided to start a new diary today, regarding the fake domains for donations to the Katrina Hurricanes victims.

We updated yesterday´s diary with the information of fake emails and domains being used to get donations for the Katrina Hurricane and Brian Krebs just updated the Security Fix blog, with new informations about these fake domains.
Some that we strongly suspect so far are katrinahelp.com , katrinarelief.com and katrinacleanup.com.

While trying to do our part, we try to reach the websites administrators. For our surprise, while talking to one of the hosting company of one of the sites, an administrator said:

"Youll have to take that up with paypal we dont govern that sorta thing...while it is well known for scammers to benifit from diasters but unless its harming our network or solid proof that there is damage being done, theres not a whole lot we can do :-/

I can't exactly turn a site off based on a assumption.."

We got information that there are plenty of domains for sale at eBay, related the Hurricane. A quick look at whois services for Katrina name can show you some interesting names...

While some are currently being used to get users/passwords, much can be done with these fake domains, from getting money through fake foundations, or even lead you to install malicious software in the machine.

If you plan do donate, we recommend that you refer to fema.gov for a list of reputable agencies or donate to organizations you trust and have past experience with.

Microsoft Security Advisory (897663)
Windows Firewall Exception May Not Display in the User Interface
Published: August 31, 2005

Microsoft has received a report of an unexpected behavior in the way that the Windows Firewall User Interface handles malformed entries in the Windows Registry. By creating malformed Windows Firewall exception entries in the Windows Registry, an exception could be created in the firewall that would not be displayed in the Windows Firewall User Interface. However, this exception is displayed by the command line firewall administration tools.

It is important to note that this is not a vulnerability. Administrative privileges are required to access the associated section of the Windows Registry that contains this configuration information. By using documented methods to manage and create Windows Firewall exceptions, it is unlikely that a malformed registry entry will be produced which would exhibit this behavior. It is more likely that an attacker who has already compromised the system would create such malformed registry entries with intent to confuse a user.

Microsoft plans to include an update to address this concern as part of a future service pack on the affected supported platforms.

You can read the entire advisory here: Microsoft Security Advisory (897663): Windows Firewall Exception May Not Display in the User Interface

Here is to hoping that John’s parents have something to come home to, but it sure doesn’t look good.

Katrina....That Beach!

Katrina....That Beach!

My parents live in Biloxi. They were smart and headed to my sister's in Atlanta Sunday morning. After reading all the details from the storm, looks like their house may be toast.

Please keep them in your thoughts and prayers.

-JFH

Zotob Arrests Highlight Cybercrime Organization

Investigation shows how worm writers and Web gangs work together, experts say.

Jaikumar Vijayan, Computerworld
Wednesday, August 31, 2005

The expanding investigation into this month's Zotob worm outbreak is uncovering evidence of the growing nexus between worm writers and gangs looking to profit from cybercrime, according to security experts.

The FBI this week confirmed that Turkish law enforcement officials are investigating 16 more suspects in connection with the Zotob worm and its variants.

This follows last week's arrests of Farid Essebar, an 18-year-old Moroccan believed to have been responsible for writing the Zotob and Mytob worms, and Atilla Ekici, a 21-year-old man from Turkey who apparently financed the effort.

According to an FBI spokesperson, the 16 individuals now being investigated are not believed to have any direct links to the actual creation and dissemination of the worms that hit several large organizations two weeks ago. Rather, "it looks more like they are associated with a credit card theft ring" possibly linked to the worms, he says.

The news is further evidence of the growing alliance between hackers and those seeking to profit from cybercrime, says Graham Cluley, a senior technology consultant at antivirus firm Sophos.

"It is certainly something that we thought has been happening for some time," Cluley says. "What you are likely to see here over the next few days is the unraveling of an entire identity fraud gang."

Read the rest of the story here: PCWorld.com - Zotob Arrests Highlight Cybercrime Organization

FEMA: Cash Sought To Help Hurricane Victims, Volunteers Should Not Self-Dispatch

For those of you that would like to donate hurricane disaster relief, here are some contact numbers from the FEMA website

 Here is a list of phone numbers set up solely for cash donations and/or volunteers.

Donate cash to:

American Red Cross
1-800-HELP NOW (435-7669) English,
1-800-257-7575 Spanish;

Operation Blessing
1-800-436-6348

America’s Second Harvest
1-800-344-8070

Donate Cash to and Volunteer with:

Adventist Community Services
1-800-381-7171

Catholic Charities, USA
703 549-1390

Christian Disaster Response
941-956-5183 or 941-551-9554

Christian Reformed World Relief Committee
1-800-848-5818

Church World Service
1-800-297-1516

Convoy of Hope
417-823-8998

Lutheran Disaster Response
800-638-3522

Mennonite Disaster Service
717-859-2210

Nazarene Disaster Response
888-256-5886

Presbyterian Disaster Assistance
800-872-3283

Salvation Army
1-800-SAL-ARMY (725-2769)

Southern Baptist Convention -- Disaster Relief
1-800-462-8657, ext. 6440

United Methodist Committee on Relief
1-800-554-8583

For further information: visit the website for the National Voluntary Organizations Active in Disaster (NVOAD) at: http://www.nvoad.org/.

FEMA prepares the nation for all hazards and manages federal response and recovery efforts following any national incident. FEMA also initiates mitigation activities, trains first responders, works with state and local emergency managers, and manages the National Flood Insurance Program and the U.S. Fire Administration. FEMA became part of the U.S. Department of Homeland Security on March 1, 2003.

Symantec has updated their Zotob removal tool to cover the following:

 August 26, 2005: Published version 1.8.0 which supports removal of more samples of W32.Zotob.E@mm

So far this covers these Zotob variants: 

• W32.Zotob.A
• W32.Zotob.B
• W32.Zotob.C@mm
• W32.Zotob.D
• W32.Zotob.E
• W32.Zotob.F
• W32.Zotob.G
• W32.Zotob.I
• W32.Zotob.J@mm 

 You can download the tool here: Symantec Security Response - W32.Zotob Removal Tool

Rod and some others let us know about the ITMU webcast from the other day.  If you missed it, it is available for download now.

The text questions and answers that were asked during the webcast won't be available for download, but I saved as many as I could before the message window filled up.  There is some pretty important stuff in here, so read away.

Question: How about support for Exchange? Minimum version required?
Answer: Exchange 2000+ is supported for patching

Question: I hear there are issues with installing secondary site servers on domain controllers, in particular to IIS and bits. Is this true, and if so, do we have fixes?
Answer: I'm not aware of these issues. I've seen problems occasionally on Windows 2000 Servers with IIS metabase corruption which can require you remove and reinstall IIS, but nothing specific to Domain Controllers.

Question: I've noticed that IE patches (MS05-038) distributed thur SMS Software Update times out on the PC with a Failsafe timeout. The patch was successful on about 50% of our PC's. The others get the Failsafe Timeout. Is their a known issue?
Answer: Through ITMU or MBSA-based scanner? In MBSA-based scanner, you should check the command line for the update. It is IExpress package so it should be /q:a /r:n. ITMU deployment should handle that for you.

Question: Is there a preferred order for installing the prerequites? Should all the server side software be installed before upgrading the sms clients?
Answer: No preferred order, other than you should apply the updates prior to installing/using ITMU.

Question: Can a secondary site run on a NAS?
Answer: No

Question: Are these queries provided with ITMU
Answer: I don't know about these queries specifically, but guidance is provided in the pre-installation guide on how to check for the pre-requisites.

Question: Can we run a share Disstribution point on a NAS
Answer: No, this is not a supported platform.

Question: So, if we're one of those silly customers that customized the sp1 mof, and did not add the sp1 changes to our custom mof, is it enough to change it on the servers, or do we have to distribute it to all clients for local compile?
Answer: I believe you'd need to recompile on the clients.

Question: Is there any documentation/examples that can be referred to for deploying WSUS via SMS to non-englsih Operating Systems?
Answer: I'm not aware of anything that specifically addresses non-english OSes.

Question: Are there any additional bandwidth concerns we should be aware of when using ITMU?
Answer: Nothing different from core SMS software distribution considerations. If bandwidth is an issue, be sure to keep Software UPdates package sizes manageable, as distribution/replication of this could be quite expensive. For software updates - be careful when using Download and Execute option in advertisement properties, as it could grow quite large if you keep using the same package with new updates.

Question: why cant install kb901034 on german sms2003?
Answer: Make sure you are using the DEU version. ENU version will not install on German SMS Site Server.

Question: MOF Again... The confusing point for me, I didn't send out any mof to recompile when we moved to SP1. Through what mechanism does the sp1 client create classes?
Answer: Correct, you wouldn't have needed to, the initial install of the SP1 client would have done this.

Question: How do you check the XML version on each client workstation?
Answer: You could collect software inventory for the xml specific files and verify the version of them (such as msxml.dll, etc.)

Question: Is there a document describing how to remove obsolete entries from the Update Type selection drop-down in the Distribute Software Updates Wizard? For example, the February 2005 extended update tool left an entry even after upgrade/removal, and we still have "Security" listed from the really old update tool.
Answer: Update type is retrieved from the UpdatesSummary table and that data will get phased out as old patch data is not reported. 90 days I believe is the time.

Question: Does the Automatic Updates Service have to be enabled and started on workstations for this to work?
Answer: Yes, the service must be enabled - however, automatic updates do not have to be turned on through the control panel->Security Center.

Question: Since the Automatic Updates service is a requirement, is it OK to turn off Automatic Updates in Control panel but still have the AU service set to Auto and have it running? I don't want users to automatically pull down their own hotfixes from the Windows Update site.
Answer: Yes, exactly

Question: what is the minimum version of msxml required for the clients to run the scans?
Answer: MSXML 3

Question: is msxml 3.0 or later included in windows 2000 sp4 and greater?
Answer: Yes.

Question: " I'm not aware of anything that specifically addresses non-english OSes" Are you implying that the process and KBs that need installed are the same for non-english OSes?
Answer: There are language specific versions of the hotfixes, but the changes made to support ITMU are not language specific.

Question: I have French client. It there a big concern for agents updates^
Answer: Not sure you what you mean. French should work just fine.

Question: Is the ITMU the long awaited update to utilize mbsa 2.0 and the same patch catalog as WSUS server?
Answer: ITMU actually uses the Windows Update agent, not MBSA, but it does use the same catalog content as WSUS (offline).

Question: Will ITMU have multilanguage version?
Answer: There's not a multi-language version, but there will be versions for the core OS languages (English, German, Japanese), and it supports ICP clients (installed from sites with ICP1 or ICP2 installed).

Question: How will a pre-existing WSUS installation affect deployment of ITMU?
Answer: It shouldn't affect anything. However the systems will work independently to patch machines. When SMS is using AU, it will lock the agent and not allow any other calls. This would prevent WSUS from deploying at the same time.

Question: Do we have to get the command line parameters right still or does ITMU grab those for us now?
Answer: ITMU does that for you now.

Question: After running KB901034, I started having problem with my Deafault Web site not running. Some how it have entered a duplicate host header. Is this normal?
Answer: Mike, this is definitely not normal. I can't give you timely advice on this in this forum, so you may want to contact Microsoft Product Support Services.

Question: I've also noticed that IE patches (MS05-038) distributed thru SMS Software Update times out on the PC with a Failsafe timeout. The patch was successful on about 50% of our PC's. The others get the Failsafe Timeout. Is their a known issue? We used MBSA 2.x to scan. Manually executing the MS05-038 patch runs very quickly. I've noticed that IE patches (MS05-038) distributed thur SMS Software Update times out on the PC with a Failsafe timeout. The patch was successful on about 50% of our PC's. The others get the Failsafe Timeout. Is their a known issue?
Answer: SMS uses a special deployment package because MBSA would offer the patch on NT4 and it would fail. So SMS uses an SMS deployment wrapper which is IExpress which uses /q:a /r:n. That is most likely the issue. Please check your command line.

Question: are there any known issues with downloading the updates through the dsuw. dsuw keeps hanging on us and requires a reboot to continue downloading updates
Answer: Don't know of any issues around this. Check your connectivity and review the logs (located in ccm\logs directory) for possible errors.

Question: Is the test client nothing more then a member of a test collection?
Answer: yes

Question: Do Scanwarpper and SMSWusHandler reside in the same directory?
Answer: yes

Question: Do you have to enable the Automatic Updates service for this to work?
Answer: Yes, you must have the Automatic Updates service running for Scan/Update in ITMU to work.

Question: where can i find the DEU 901034 i only find ENU
Answer: Those may not be made available until the German version of ITMU is released.

Question: Why are Updates stored in a hardware inventory?
Answer: Hardware inventory and the corresponding WMI classes are used for patch management data.

Question: For us that need to get started, we need to deploy either the process of 901034 or the other two hotfixes on all existing clients? Wally presentation *assumes* this was done.
Answer: Yes, that's correct - the clients must be running the updated client.msi or the updates to the SP1 version of the advanced client.

Question: If you have to enable the Automatic Updates service then how do you keep updates from getting downloaded from MS automatically?
Answer: Turn off the option to automatically update in Control Panel->Security Center. THis can also be enforced via Group Policy.

Question: The wizard for deploying updates will that be resizable window?
Answer: No, it is still not resizable, sorry.

Question: If the Automatic Updates service must be running for Scan/Update in ITMU to work, is their a package/program that SMS can push to install/update this service setting? Question: where can i find the DEU 901034 i only find ENU
Answer: There's not a package/program available for this - you can use Group Policy in Windows to perform this.

Question: Does Microsoft have any "Best Practices" for creating Software Update packages? In other words, what if you wanted to rollup two months of updates into a single package ? Also, can you rollup Windows 2000 and XP Pro into one as well?
Answer: You can create large packages or smaller packages it is up to you. When determining how large a package to create, you need to consider bandwidth of your clients. Large pacakges with download and execute are downloaded in full to the client. If your clients are not mobile and have stable network connections, you should create large packages and run from distribution points. If many of your updates require reboots, it is better to chain them together to reduce reboots required on the target machine. If they do not require reboots and you want to take advantage of BITS and download/execute, then create smaller packages. It really depends.

Question: Is it possible for an attacker to falsify the patch compliance information stored in wmi?
Answer: Does the attacker have administrative rights to the box? If so, yes. If not, no. The namespace is ACL'ed such that only authorized principals can update.

Question: AU can be set to manual and still function properly, correct? Just can't be disabled AFAIK
Answer: I believe that's correct: it supports on demand start via com

Question: so do you remove the old software updates node when yu switch over to ITMU?
Answer: No, the ITMU updates appear in this node alongside other scan types.

Question: Will these Questions and Answers be available for review?
Answer: You

Question: Will applying the hotfixes individually on some clients and pushing out the new client to others result in the same client version?
Answer: No, if you apply the two individual hotfixes, they just update the components required for ITMU support, not the full client version. If you apply the new client, this updates the client version completely.

Question: As the wu agent controls installation of the hotfixes, does the tracing of the logs still load in the %windir% folder?(Whereas, if the patchinstall program failed with an irrecoverable error there were no logs unless you enabled voicewarmup.)
Answer: You will have patchinstall logs and wu logs. Windows Update will log its scan activity as well.

Question: when will you release the German ITMU
Answer: We are currently finishing up translating the final few documents for the tool. It should be released soon.

Question: Does ITMU simplified Language specific hotfixes distribution? I know that with SUS, we didn't have to worry about it and Software updates

with SMS 2003 appeared to make it a bit more difficult. My point is that I want to make patch distribution as transparent has possible for both languages.
Answer: Yes. ITMU automatically handles all language updates supported by a patch. It is much improved over previous tools.

Question: Can I set up a DP in a different Domain without a SMS site online (A share DP not a Standard SMS DP)?
Answer: Not sure I understand the Question, but the SMS Site server is required to update Distribution Points, share or system.

Question: Will the SP-2 installation be more simplified than the ITMU install process or will it be this current process plus other steps?
Answer: It will be more simplified as all the prerequisite hotfixes will be included in SP2 installation

Question: Will ITMU better handle versioning of Hotfixes? Rereleases like MS05-019 caused severe problems with the old feature pack.
Answer: The catalog used by ITMU should handle these kinds of issues more smoothly, and centralizes the updates so there's less confusion.

Question: It sounds like I could package updates for Office, XP SP1, XP SP2, IE, Exchange, etc..... all in one package?
Answer: Yes you could.

Question: Which requirement will require reboots on the client? Server?
Answer: The only restart requirement is for the Windows Installer (MSI) 3.1 pre-requisite. All SMS client and Server updates do not require a restart.

Question: When will the vulnerability class be used? I thought ITMU was going to use it, but I guess not.
Answer: Right, vulnerability is a different tool, TBD.

Question: Since ITMU creates a Win32_Patchstate_Extended WMI class, does it remove the old Win32_Patchstate class? If its still there, wouldn't it still be picked up in the HW Inv and therefore the old tool info would still be added to the DB with every HW Inv cycle?
Answer: The Win32_PatchState is not removed, and would continue to be reported.

Question: will the ITMU be part of SP2 by default
Answer: The tool will be available for installation as part of SP2 and all prereqs will be included in the SP2 installation.

Question: If SP-2 includes the hotfixes and the ITMU, why wouldn't I wait for it, rather than going thru this? How soon will SP2 beta go "prod"?
Answer: I guess if you didn't need the features from ITMU right now, you could wait. SMS 2003 Service Pack 2 is anticipated early 2006.

Question: With WSUS, a simple domain policy enables us to report patch status on all domain workstations (many thousands of them). With ITMU, do we have to push the Advanced Client to all domain-connected systems in order to report patch status?
Answer: You would, yes.

Question: We have many clietns where the AU service is disabled and I saw no problems. Are you sure it has to be enabled?
Answer: If the actual AutomaticUpdates service in service manager is disabled, ITMU detection and deployment should not succeed. That is different than disabling automatic updates through the control panel.

Question: When does the patch status change to installed in the database? After the install, reboot, and hw inventory? Or does another scan/hw inventory have to run after the reboot?
Answer: After the install, reboot and status message, you should see the status change. You do not need a full h/w cycle

Question: I know we will see it shortly in the demo, but has the DSUW window size been increased. In particular, the screen where you select the updates is unmanageably small. If it hasn't been enlarged, what technically is preventing this from being fixed?
Answer: You will see shortly that it has not. There are no plans to change it in the current version of SMS.

Question: Can a standalone scan package or patch package be created with ITMU engine or is SMS required?
Answer: SMS is required. You could code your own offline wsusscan.cab scan tool as the Windows API's are there for such a thing. However, SMS is a great way to integrate the WUA scan and deployment technology for enterprise customers.

Question: Are you saying there are no plans to increase the DSUW window size even in SP2?
Answer: Correct.

Question: Does the old info in software updates get overwritten?
Answer: No, that data as well as the old scan tools can still be used along side ITMU.

Question: Does the windows update agent service have to be set to Automatic for ITMU scanning to work, or is Manual sufficient?
Answer: If it is manual, SMS agent will start it prior to scan.

Question: Is smswish@microsoft.com the place where we'd suggest improvements for SMS (like the DSUW window size thing)?
Answer: Absolutely.

Question: Does the ITMU have to scan machines before it will show patches?
Answer: No, you will see patches in DSUW before scans take place. This is if you need to deploy a patch quickly before scans have completed.

Question: Could you ask the devolpers to entertain the idea of making the DSUW window sizeable and/or enlarging it?
Answer: Yes.

Question: It must be one of the UNIX Admins type of things - "It's hard and we like it that way"?! Can we get the email address of the responsible programmer so we can send hate mail? Just kidding. Sort of. Well, not really. We REALLY hate it - it's like being back in the Windows 3.1 days. Must have been programmed in VB.Net 1955.
Answer: :-)

Question: i installed updates with this new tool and the machines rebooted... are you sure you need no switches?
Answer: If the patch absolutely requires a hard reboot before other patches are applied, reboot will take place. Very few patches have this requirement.

Question: The ITMU tool was installed about 2 months ago at my site. I like to update it with the latest version. Can I just run the latest version?
Answer: You should apply all the latest prerequisites and then upgrade the scan tool. I would suggest deploying the latest WUA separately as the dependent program history will have shown that it ran with your previous installation.

Question: For ITMU what shud be the security mode on server ..Advanced or Standard?
Answer: There's no requirement for either mode.

Question: is there anyway to get ITMU to show ONLY certain update (example, only W2K or WXP) and not others
Answer: You can filter in the DSUW wizard by product, kb, etc.

Question: Quick Question... can you rollup Windows 2000 Pro and XP Pro updates into a single package or is this not adviseable? I'm assuming ITMU will install the correct OS version?
Answer: There shouldn't be any problem with creating packages that span OS's. SMS will take care of things.

Question: Any SPs required for Windows 2003?
Answer: No. RTM is supported currently.

Question: ITMU has been installed on my lab on the Central Site Server. All ITMU hotfixes have been installed on Central and Primary Site Servers. When I run the Software Compliance report in the Primary site there is no data returned. If the same report is run from the Central Site data is returned. Is this by design?
Answer: The software compliance reports are updated to look at additional tables/data, you'd need it installed at the Primary Site to see them there.

Question: Can these queries be distributed?
Answer: I don't know of any plans to provide them after the WebCast, if that's what you are asking. Question: Where can I download the neccessary files to pre-stage the installation from local source?
Answer: Sorry, to pre-stage the installation of what (I'm missing context here, most likely :))

Question: Does ITMU only have to be installed at the central site? That is how MBSA 2.0 is installed in my environment now.
Answer: This will work, yes. Keep in mind that reporting will not work at child sites, however.

Question: if i install 901034 900257 and 900401will that change any reports before installing imtu?
Answer: No, it will not.

Question: Are there any special instructions for installing the new SMS Client on the SMS site server? We have a 2003 server that will not upgrade the client as the SMS Client Host service is busy and will not exit.
Answer: There's no special instructions beyond what's provided in the Pre-Installation guide - this sounds like a problem that you should work with our Product SUpport Services on.

Question: I just verified that the AU service must be set to at least manual. This should be listed as a requirement! We will not be able to go forward using ITMU as our company policy calls for this service to be disabled.
Answer: Please check out the readme which discusses this. There are many group policies that will lock down all Windows update features on the desktop, but still allow the AutomaticUpdates service to be enabled. Please review the readme and reconsider.

Question: My environment has about 5,000 clients on SMS SP1. I would like to lower my software and hardware inventory cycles to 12 hours. Is this ok and what could be average size of the inventory data deltas?
Answer: The Answer to this really depends on what your environment (network/server hardware, etc.) is like. I can't give you a yes/no Answer. In general, make small changes to schedules and monitor closely.

Question: We have had issues with WMI repository corruption on some workstations, won't this cause MBSA or ITMU scans to fail? Any ideas on what causes this corruption?
Answer: This could certainly cause problems, as we use WMI to store scan data. No specific ideas on what the problems could be, sorry.

Question: How will sms SP2 affect users that have ITMU installed now? will it just overwrite the current ITMU install or ?
Answer: SMS 2003 SP2 will include the pre-requisite SMS hotfixes, but will not overwrite ITMU. The plan currently is to provide ITMU with Sp2, but not force an install. If you did install a later version of ITMU, it would upgrade the current version, retaining your settings/config.

Question: Where can I look for information that may help me estimate my inventory (hw/sw) deltas so I can estimate what traffic to expect on my network based on decreasing/increasing my inventory schedules?
Answer: Check out the SMS 2003 Capacity Planner: http://www.microsoft.com/downloads/details.aspx?familyid=009e0c30-bded-4b95-a8f9-06037de85c57&displaylang=en

Question: Looks like we can recur patch distributions. Is it best practice and recommended that we recur distributions of patches? I am concerned with network traffic.
Answer: Yes, you can do this - how often is up to you.

Question: if the ITMU tools are installed at the Central Site, could I push out the patches from a Primary Site server?
Answer: You'd need to install ITMU on that Primary Site.

Question: if i need to isntall the ITMU tool on the Primary site server to push out patches and view updated reports, why would i install the ITMU tool on the Central site server?
Answer: To view reports and push out from the Central site server as well.

Question: How long should we keep the recurring monthly patches active? Couple of weeks, month, ??? If we keep these all active and recurring, clients will start getting hammered with advertisements over time. At what point do you go to a 'cleanup' mode of operation?
Answer: Best practice would be to consolidate so you don't have a bunch of advertised software updates out there. When you switch to a new advert/package would depend on how long it takes to get compliance on each set. You could do every 3 months, for example, with a 2 month overlap between updates.

Question: we have 9 Primary sites including 1 central site and 41 secondary sites - do all sites need to be updated with all patches and the ITMU or just the central site?
Answer: ITMU would need to be installed on the Central Site, the SMS hotfixes / advanced client update needs to happen everywhere as well as anywhere with an MP installed.

Looks like while I was keeping track of the hurricane baring down on us that I missed the fact that this blog passed the 20,000 mark in unique visitors! 

According to that stats on my counter configuration page, I am almost at 27,000 page loads.

Hurricane Katrina decided to come after us up here in northeast Mississippi, but we made it through OK.  It got pretty ugly here last night, with winds gusting up to 60–75 miles an hour.  It was raining so much that I am sure that areas of town are flooded, but so far I haven’t heard how bad. 

Compared to the rest of the state, especially down on the Gulf Coast; I know that we got off easy.  My Wife and I will keep everyone else affected by this powerful hurricane in our thoughts.  Hang in there everyone.

SANS - Internet Storm Center - Cooperative Cyber Threat Monitor And Alert System - Current Infosec News and Analysis

Updated Windows Registry Concealment Info

First of all thank you once again to the scores of people who have sent us data, suggestions, code, test results, etc on this issue. We could not provide what we do to the community without this collective worldwide effort.

We have started to see some possible reports of malware which utilizes this concealment technique in the wild. We expect this trend to continue over the life-cycle of the next few weeks as vendors patch their products as necessary to allows these keys to be visible to their scan engines.

With the help of you all we have been collecting reports of what products/versions deal with this issue well or not at all. If you see any inaccuracies or omissions please let us know.
Please don't take this as product bashing. Everyone we've talked to is interested in handling this issue and getting patches out as necessary. However we think its important for users to know if they may have a blindspot in their local system security. I think the take home here is that a malware scanning utility (be it Anti-Virus, Anti-Spyware, etc) that can watch over your registry for you is a critical part of keeping safe and that it will be important to many to watch for product updates in the coming weeks and to get updated (not to mention regular updates, sigs, etc)

Its important to note that many products have several registry-related functions. And each function does not necessarily work as well as others in regards to this issue.
Also version information was not included in all submissions. So if you see a product listed here without a version. It means it might be a good idea to double check, but don't freak out. Also its important to note that this information is being provided in the hopes you may find it useful. It doesn't imply an opinion, endorsement, etc of SANS or the ISC. Also this list is by no means exhaustive. We're all volunteers just trying to lend a hand and there's only so many hours in the day to analyze, evaluate, test, etc

Products that have been reported to be able to query/report/delete/etc these keys:

AppSense Environment Manager
HiJackThis v1.99.1 (SCAN function)
HiJackThis v1.99.2
Stillsecure SafeAccess
Sysinternals Autoruns (mixed reports)
Regedt32 (Win2k)

Products that have been reported to not be able to see this keys (at least in some versions) or to behave unexpectedly (crash, etc)

AdAware
Autoruns 8.13
MS AntiSpyware Beta
HijackThis v1.97.0.7
HiJackThis v1.99.0
HiJackThis v1.99.1* (Generate StartupListLog)
Msconfig (WinXP)
Norton SystemWorks 2003 Pro
RegAlyzer 1.1
RegEdit
reg.exe (under some circumstances)
Registry Explorer 3.0.0.276
Spybot S&D
WinDoctor v. 7.00.22

Products which have a registry watching function that may not be able to see the key once set, but can detect/alert an attempt to set a key (of varying lengths including overly long ones) Spybot S&D TeaTimer

Helpful tools/Tips
Cygwin regtool
(example: regtool list /HKLM/Software/Microsoft/Windows/CurrentVersion/Run)
Cygwin ls
(example: ls -l /proc/registry/HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/Run)
Perl's Win32::TieRegistry
regdel
System Information tool (winmsd.exe)
export registry, make your edits and then re-import

*Special Note: Merjin has been working on this class of issues and keep an eye out for v1.99.2 of HijackThis for full support in dealing with long registry keys

And the best for last. Our own Tom Liston has created, out of the kindness of his heart and his deep concern for all of humanity, a recursive registry scanner which will report on values with names in excess of 254 characters. Enjoy! And please let us know if you start finding all sorts of long entries. It will help us get a handle of the prevalence of this issue and we'll provide updates here in the diary as we figure out whats going on so hopefully the world is a little safer place.

FILE: (3584 bytes)
http://isc.sans.org/LVNSearch.exe
PGP SIGNATURE:
http://isc.sans.org/LVNSearch.exe.asc
MD5 CHECKSUM
213a9d5e91bc6527e422953ad7175a0d

If I leave anyone's name out please forgive me and/or flame me.
A big thanks to:
Aaron, Adam, Alan, Bill, Daniel, Eduardo, Frank, Iain, John, Juanma, Linford, Luis, Merjin, Merrill, Michael, Niels, Randall, Robert (not me, another one), Simon, Tom, and all of the folks on the DShield Forum.

Thought I was kidding didn't you. Thats just folks that have helped us out in the last 24 hours.
You guys rock.

- Advisory Web site: http://go.microsoft.com/fwlink/?LinkId=51466

I hope everyone turns out to be OK. 

I never had to work out in the “Area” as it was called, but plenty of my friends and co-workers did (and my Wife for that matter). 

I’ll take Southern heat and humidity over nuclear waste any-day…

FOXNews.com - Wash. Nuke Dump Evacuated After Leak

Wash. Nuke Dump Evacuated After Leak

Wednesday, August 24, 2005

RICHLAND, Wash. — The U.S. Department of Energy (search) evacuated some workers at the Hanford (search) nuclear reservation Wednesday morning after suspected breach of a container.

The incident occurred at the 200 West area of the south-central Washington site, where workers have been unearthing containers of waste that had been buried for years. The site is also near a landfill where some waste is being permanently buried.

Workers were evacuated from a trench as a precaution after the suspected breach at 10:35 a.m. PDT, said Calvin Dudney, a member of the joint information center at Hanford. Workers in the area were advised to take cover in secure buildings nearby.

A brown absorbent material escaped from a 55-gallon drum, and workers immediately halted work and evacuated the area. Two workers closest to the drum were given nasal smears and showed no contamination, Dudney said. Nine other workers in the area also were evacuated to a safe building nearby and showed no contamination.

No other information was immediately available.

The State Emergency Operations Center was activated at 11:05 a.m. to monitor the situation and assist Benton, Franklin and Grant counties if emergency operations become necessary.

For 40 years, the 586-square-mile Hanford nuclear reservation made plutonium for the nation's nuclear weapons arsenal, beginning with the top-secret Manhattan Project (search) to build the atomic bomb.

Today, it is the nation's most contaminated nuclear site, with cleanup costs expected to total $50 billion to $60 billion. The work is scheduled to be completed by 2035.

Update: Looks like things weren't too bad, I got this from an “inside” source

Symantec has updated their Zotob removal tool to cover the following:

 August 24, 2005: Published version 1.7.0 which supports removal of W32.Zotob.J@mm

So far this covers these Zotob variants:

• W32.Zotob.A
• W32.Zotob.B
• W32.Zotob.C@mm
• W32.Zotob.D
• W32.Zotob.E
• W32.Zotob.F
• W32.Zotob.G
• W32.Zotob.I
• W32.Zotob.J@mm

You can download the tool here: Symantec Security Response - W32.Zotob Removal Tool

Keep in mind that the K and L variants are out there now as well.

This is just plain ugly..

SANS - Internet Storm Center - Cooperative Cyber Threat Monitor And Alert System - Current Infosec News and Analysis

Nasty Games of Hide and Seek in the Registry

Hide
What started like a nice and quiet day ended with the potential for lots of nasty surprises. A reader alerted us to a vulnerability note published by Secunia that on first sight did not appear to be overly scary. Once we started to play with it, though, the nastiness became apparent: An overly long registry entry can be added, but won't be shown by regedit and regedt32. Even better, all registry entries that get added afterward under the same key, even if not overly long, will be hidden as well.

[Pause, to give your wheels some time to spin]

Yes. This allows to add hidden entries under the famous HKLM\Software\MS\Windows\CV\Run. Entries that you can't see with regedit, but that will just as faithfully get run at startup.

Seek
For a little good news, while regedit is completely blind, the command line "reg" utility can see the entries, apparently.

C:\>reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run

is the command to use. If it shows you start-up entries that you can't see in regedit, you just found a glitch in the Matrix.

Another faithful tool that doesn't lie like regedit is the tried and true "Autoruns" from Sysinternals: http://www.sysinternals.com/utilities/autoruns.html


Zapp
Once you've found them, getting rid of the offending registry entries isn't too easy, either. What worked for us during the tests was again "Autoruns" from Sysinternals, presumed you use the current (8.13) version. Older versions seem to occasionally choke on the long keys. Another approach one of the handlers used successfully was to do a "reg export" on the command line of the entire "Run" key. Then he manually deleted the entire "Run" key from the registry, edited the exported file to remove the offending keys, and re-imported the reg file, thus recreating the "Run" key.

Of course, the usual disclaimer applies when you are monkey-wrenching the registry. You have been warned.


Let us know!
If you come across a tool that does or doesn't show or remove these hidden keys, please let us know. We'll update the diary accordingly.

Update 20:21 UTC: Spybot S&D, AdAware and MS AntiSpyware Beta don't seem to find anything offending with the long key. "Show Autostarts" of MS AntiSpyware Beta does not list the hidden keys. Spybot S&D TeaTimer will intercept the registry key from being added.

- http://www.microsoft.com/technet/security/bulletin/MS05-030.mspx

Symantec has updated their Esbot removal tool.  Here is what is in the new version: 

To date, this tool covers the following:

• W32.Esbot.A
• W32.Esbot.B
• W32.Esbot.C

You can download the updated tool here: Symantec Security Response - W32.Esbot Removal Tool

Symantec has updated their Mytob removal tool.  Here is what is in the new version: 

At this point, this tool covers the following:

• W32.Mytob@mm
• W32.Mytob.B@mm
• W32.Mytob.L@mm
• W32.Mytob.M@mm
• W32.Mytob.R@mm
• W32.Mytob.U@mm
• W32.Mytob.V@mm
• W32.Mytob.AG@mm
• W32.Mytob.AH@mm
• W32.Mytob.AS@mm
• W32.Mytob.BE@mm
• W32.Mytob.BV@mm
• W32.Mytob.CF@mm
• W32.Mytob.CH@mm
• W32.Mytob.CU@mm
• W32.Mytob.CY@mm
• W32.Mytob.DA@mm
• W32.Mytob.DB@mm
• W32.Mytob.DF@mm
• W32.Mytob.DJ@mm
• W32.Mytob.DL@mm
• W32.Mytob.DP@mm
• W32.Mytob.DV@mm
• W32.Mytob.EB@mm
• W32.Mytob.EC@mm
• W32.Mytob.ED@mm
• W32.Mytob.EE@mm
• W32.Mytob.EG@mm
• W32.Mytob.IE@mm

You can download the tool here: Symantec Security Response - W32.Mytob@mm Removal Tool

Microsoft Security Advisory (906574)
Clarification of Simple File Sharing and ForceGuest
Published: August 23, 2005

Microsoft has issued this Security Advisory to clarify information of the issue addressed in Security Bulletin MS05-039 for non-default configurations of Windows XP Service Pack 1. This feature is known as “Simple File Sharing and ForceGuest.” If you are using Windows XP Service Pack 2, enabling Simple File Sharing and ForceGuest does not increase your level of exposure to the MS05-039 security vulnerability. Also, customers that have applied the security update included with MS05-039 are not impacted by this issue. We recommend that customers continue to follow our Protect Your PC guidance of enabling a firewall, getting software updates and installing ant-virus software. Customers can learn more about these steps by visiting the Protect Your PC Web site.

If Simple File Sharing is enabled on a Microsoft Windows XP system that is not joined to a domain, then all users who access this system through the network are forced to use the Guest account. This is the “Network access: Sharing and security model for local accounts” security policy setting, and is also known as ForceGuest.

Windows XP mitigates several security vulnerabilities by preventing users who do not have a valid logon credential from accessing the system remotely. An example of this is the vulnerability that is addressed in Microsoft Security Bulletin MS05-039. However, when you enable Simple File Sharing, the Guest account is also enabled and given permission to access the system through the network. Because the Guest account is a valid account when it is enabled, and is given permission to access the system through the network, an attacker could use the Guest account as if they had a valid user account.

There is no known attack that is seeking to exploit this scenario. The Advisory is being issued as a special precaution. There is no change to the update in Security Bulletin MS05-039. Customers who have applied this update are protected in this scenario.

Mitigating Factors:
•Windows XP Service Pack 2 is not vulnerable remotely to the issue addressed by MS05-039 even when Simple File Sharing enables the Guest account. On Windows XP Service Pack 2, the impact of this vulnerability is only Local Privilege Elevation, and only exploitable if a user has the ability to logon locally to the system.

•Simple File Sharing is not available on Windows XP systems that are joined to a domain. Domain-joined systems use standard file sharing which does not enable the Guest account or give it permissions to access the system through the network. Windows XP Service Pack 2 is not vulnerable remotely in domain-joined systems or in workgroup-joined systems.

•Enabling Simple File Sharing does not expose customers who have applied the security updates provided by Microsoft Security Bulletin MS05-039 to the vulnerability that is addressed by that security bulletin.

Read the rest of the advisory here: Microsoft Security Advisory (906574)

US News Article | Reuters.com

WASHINGTON (Reuters) - More than 33,000 U.S. Air Force officers could be at greater risk of identity theft after a "malicious user" accessed a database containing personal information, an Air Force official said on Tuesday.

The attacker used a legitimate password to access a database that contained birth dates, Social Security numbers and career information for about half of the Air Force's officers, as well as a handful of noncommissioned officers, Master Sgt. Randy Mitchell said.

Personal financial records and classified military information are not included in the career-management database, Mitchell said.

The incident has not led to any known instances of identity theft but the Air Force is urging those affected to monitor their credit records, he said.

"We're not sure what the person was doing inside the system, if they was just being curious and going through all these records or what, but nobody's information has been used in an illegal way that we know of so far," Mitchell said in an interview.

A rash of security breaches at businesses, universities and other institutions have put at least 50 million U.S. consumers at heightened risk for identity theft over the past year.

Congress is considering several bills that would tighten computer-security standards and improve consumer protections when such incidents take place.

SANS - Internet Storm Center - Cooperative Cyber Threat Monitor And Alert System - Current Infosec News and Analysis

More about Msdds.dll issue
The Microsoft updated their security advisory the Msddsl.dll exploit issue. The updated version contains additional information regarding what applications ship the affected DLL and are configured in a vulnerable state.

Following statements are summary of updated information.
The affected versions of Msdds.dll are 7.0.9064.9112 and 7.0.9446.0. Customers who have Msdds.dll with version 7.0.9955.0, 7.10.3077.0, or higher on their systems are not affected by this vulnerability.


The Microsoft DDS Library Shape Control (Msdds.dll) does not ship in the .NET Framework.

Microsoft Office 2003 are not affected by this vulnerability. (ships a higher version dll)

Microsoft Access 2003 are not affected by this vulnerability. (ships a higher version dll)


Microsoft Visual Studio 2003 are not affected by this vulnerability. (ships a higher version dll)


Microsoft Visual Studio 2002 Service Pack 1 are not affected by this vulnerability. (ships a higher version dll)


Microsoft Office XP Service Pack 3 are not by default affected by this vulnerability. However, its only in a vulnerable configuration if VS runtime library files are in the search path for Internet Explorer. These files are Msvcr70.dll and Msvscp70.dll. For instance by placing them in the same directory as Msdds.dll or in the %windir%/system32 directory could expose Office XP customers to this issue.

You can find the workarounds from our yesterday's diary.

Symantec has updated their Zotob removal tool to cover the following:

The “H” variant of Zotob must not be spreading as fast as the newer “I” variant, because it looks like they skipped adding it to this removal tool for now.  Be aware of that fact when using this tool to clean computers.

So far this covers these Zotob variants:

• W32.Zotob.A
• W32.Zotob.B
• W32.Zotob.C@mm
• W32.Zotob.D
• W32.Zotob.E
• W32.Zotob.F
• W32.Zotob.G
• W32.Zotob.I

You can download the tool here: Symantec Security Response - W32.Zotob Removal Tool

I am always glad to see AV companies being proactive like this.

HTML_BINDSHELL.B - Description and solution

This is Trend Micro's detection for the proof-of-concept HTML script that exploits the Microsoft DDS Library Shape Control, version 7.0.9064.9112, which is known as MSDDS.DLL. This exploit allows remote execution on an affected machine from a malicious attacker.

Symantec has updated their Esbot removal tool.  Here is what is in the new version:

 August 18, 2005: Published version 1.1.0, which supports removal of W32.Esbot.B.

To date, this tool covers the following:

• W32.Esbot.A
• W32.Esbot.B

You can download this tool here: Symantec Security Response - W32.Esbot Removal Tool

We have all noticed that a few people have decided to move their blogs over to “greener pastures”. 

Now I am sure they have their reasons, based on their own opinions, which they have every right to.

As far as I am concerned, I have been a member of what is now myITforum.com, Inc. since just about day one and I know that I wouldn’t be where I am in my career without this community's support.  Especially with the support of the email lists.

To put it simply, I am staying right here, because this is my home.