JD @ myITforum.com

Suspected Zotob Worm Authors Arrested

http://blogs.washingtonpost.com/securityfix/2005/08/arrest_of_zotob.html

“Two men were arrested Thursday on suspicion of releasing the "Zotob" and "Mytob" worms, variants of which have infected thousands of computers running Microsoft's Windows operating system.  The arrests were announced today by the Federal Bureau of Investigation.”

CNN link: http://money.cnn.com/2005/08/26/technology/worm_arrest/

Rootkits: Information and detection tools

Viruslist.com has a good read on rootkits titled “Rootkits and how to combat them”. Its a quick read that highlights rootkits and contains tips on detection. Additionally, there are several other utilities not mentioned in the article that will help you detect rootkits.

RootkitRevealer

F-Secure BlackLight Rootkit Elimination Technology

Additionally, the Microsoft Malicious Software Removal Tool will remove some of the HackerDefender Rootkits.

Zero day msdds.dll Exploit

gdiplus.dll is ringing in my head for some reason, this could be nasty.

http://isc.sans.org/diary.php?date=2005-08-18

Internet Explorer (.Net) 0day msdds.dll Exploit

As reported in yesterday's diary, FRSIRT released a 0-day exploit against Microsoft Internet Explorer 6. This exploit can also be characterized as a .Net exploit, which is accessible remotely using MSIE as a conduit. [David].

IMPORTANT: At this point, there is no patch available. Exploit code has been released and is expected to be used in the wild shortly (if it hasn't been used already).

In order to be vulnerable, you need to have 'msdds.dll' installed. Usually, this is installed by Visual Studio .Net, but has been found to be installed by a number of other applications as well, as it may be distributed with .Net based applications.

Typically, you will find it in
Program Files\Common Files\MicrosoftShared\MSDesigners7 .[Jordan]

Here is a list of applications that may install this component:
(Disclaimer: We can't test them all... but it should help you prioritize)
MS Visual Studio .Net
.Net Framework 1.1
Microsoft Office (2000, 2002, XP) [Karl, Juha-Matti]
Microsoft Project
Visio [Chris]
Access 11 (2003) runtime [Scott]
ATI Catalyst driver installed by newer ATI video cards [Eric]

MSDDS.DLL is not found on Win2003 SP1 SERVER with .net installed (not Visual Studio .net). [Andy].

Not all default Office 2000 installs have msdds.dll installed. [Emmanuel] We get conflicting reports, likely due to various configuration and install choices.

The version of MSDDS.DLL installed with Office 2003 is not vulnerable.

If you test your system using the PoC exploit, please let us know if it succeeded, and what version of MSDDS.DLL you are using. Version 7.10.3077.0 may not be vulnerable (according to Secunia and our testing). [Juha-Matti]

Version 7.0.9064.9112 is vulnerable [Gilles].

If you are able to apply content filters to your internet gateway (e.g. a proxy server), filter for this string:
(in order to allow you to still visit this page, we substituted the '-' with the word '(dash)' ...)
EC444CB6(dash)3E7E(dash)4865(dash)B1C3(dash)0DE72EF39B3F
This is the class id of the vulnerable component.

Other Mitigation Techniques:
- Use a Non-ActiveX aware browser (Firefox, Opera...)
- remove the vulnerable DLL. (we do not know what will break as a result)
- this issue can be blocked by setting the 'kill bit' for the respective DLL. Using a registry editor, set: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\EC444CB6-3E7E-4865-B1C3- 0DE72EF39B3F\Compatibility Flags=0x00000400" [Jerry] I added a space in the key to avoid the above mentioned content filter rule [John].

There is no official patch for this vulnerability at this point. MS05-038 looks similar, but the patch doesn't appear to protect you from this problem.

In a few cases, the system reported "low virtual memory" as we hit the exploit page.

MSDDS Trivia:
- MSDDS stands for "Microsoft Design Tools - Diagram Surface".
- you sometimes may find the (wrong) spelling of msdss in earlier versions of our diaries.

Related Links:
http://secunia.com/advisories/16480/

I can!

HIGH RISK- McAfee - W32/IRCbot.worm!MS05-039

More information can be found in the Breaking Virus & Security News  forum.

http://www.myitforum.com/forums/tm.asp?m=117738&p=1&tmode=1

Zotob.A uses MS05-039 Plug and Play service vulnerability

http://www.f-secure.com/v-descs/zotob_a.shtml

The worm is a packed PE executable file 22528 bytes long.

Installation to system

When run, the worm copies under %SYSTEM% directory using the name 'botzor.exe' and creates a named mutex 'B-O-T-Z-O-R'.

It then alters registry entries to ensure that it is started when a user logs on or the system is restarted:

 [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
 "WINDOWS SYSTEM" = "botzor.exe"

Spreading using Plug and Play service vulnerability

The worm scans for systems vulnerable to Microsoft Windows Plug and Play service (MS05-039) through TCP/445. If the attack is successful a shell (cmd.exe) is started on port 8888. Through the shell port, the worm instructs the remote computer to download and execute the worm from the attacker computer using FTP. The FTP server listens on port 33333 on all infected computers with the purpose of serving out the worm for other hosts that are being infected. The downloaded file is saved as 'haha.exe' on disk.

Bot functionality

The worm tries to connect to IRC channel at predefined address. The attacker who knows channel password can instruct the bot to execute the following actions:

 Request worm uptime
 Request worm version
 Shutdown worm
 Download and execute files
 Delete files
 Update worm

Other details

Zotob.A also contains the following message to AV vendors:

 MSG to avs: the first av who detect this worm will be the first
 killed in the next 24hours!!!

Microsoft Security Updates 09AUG05

Webcast - Fighting Attack and Securing the Infrastructure

Fighting Attack and Securing the Infrastructure

Session 1: Understanding and Fighting Malware: Viruses, Spyware and Rootkits

Today's internet is fraught with peril in the form of undesirable and malicious software. These types of software continue to evolve new ways of propogating and embedding themselves more deeply into the systems they infect. In this session you'll gain an understanding of their propagation methods, including buffer overflow exploits, how to detect them and how to prevent them. You'll also get a first-hand look at rootkits, which are the sophisticated tools and techniques by which malware attempts to avoid and prevent detection.

This interesting new wizard can help you author, tailor and apply security policy. As with any security policy tool it can also completely disable your network. This session discusses the internals of the security configuration wizard and how to make use of it. We cover how it relates to other security policy tools and resources, such as the Security Configuration Editor, Group Policy, and the Security Guides. We also discuss the idea of role-based security policy and how you can best leverage it to protect your Windows network.

Demonstrations: Session 1: A range of tools from www.sysinternals.com Session 2: GMPC & SCW

Speaker: Stephen Lamb, Microsoft UK Technical Evangelist for Security http://blogs.technet.com/steve_lamb/default.aspx , stephlam@microsoft.com
Steve has been a technical security specialist for over ten years. He’s passionate about using technology to free people to get on with their work confident that information is secure. Special interests include secure wireless, Rights Management, Application Layer Firewalling, Next Generation Secure Computing Base, client & server security. Steve enjoys White Water Kayaking, Snowboarding, Windsurfing, Kite Surfing and relaxing with friends & family.

Cutting edge technology ;)

I love to keep up with the times, so I went out and bought an XBOX yesterday! Of those that know me, most will tell you that I’m not a big gamer. I used to enjoy playing the likes of Galaga, Joust, Donkey Kong, and Ms. Pacman. You know, “back in the day”. Even with the XBOX 360 coming out this fall, (forgive me if this is incorrect information) for me to get an XBOX is a giant leap into technology. The bug started several months ago when I was visiting a friend. He was playing Tiger Woods 2005, and I asked him if I could have a shot at it. It wasn’t long, and I found myself ignoring my friend informing me that dinner was ready. I shouted back, "Just one more hole, and I will come eat". While I had fun, I still was not sold on the idea of shelling out a couple of hundred bucks. Last weekend, I was looking at the various games for the XBOX and noticed a particular (game?). It was Yourself fitness. It's basically a personal trainer. What a wonderful idea! It really got me thinking about the many other educational uses. They may already exist, but I’m thinking if they can have approved defensive driving courses on video, then surely a defensive driving course game (for lack of better words) could be created for the XBOX. I could see many other educational uses for the XBOX. Well its was this concept that sold me. I still think the price should be lower, but I feel that way about cars, gas, and almost everything else I have to pay for. Well I’m an XBOX owner now, and while still behind the times a bit, I’m catching up.