Nimda Worm Alert - What I've done so far.
From: Murphy, Brian (admin@carterbloodcare.org)Date: 09/19/01
- Previous message: Anthony Michaud: "RE: Nimda Worm Alert (fwd)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Message-ID: <961A9C9BD55DD41194D3009027DCF8670195414C@BEDEXCH01> From: "Murphy, Brian" <admin@carterbloodcare.org> To: "'Higgins, Lyndon'" <lhiggins@nine.com.au>, "Murphy, Brian" <admin@carterbloodcare.org>, 'Marc Fossi' <mfossi@securityfocus.com>, Focus-MS <focus-ms@securityfocus.com> Subject: Nimda Worm Alert - What I've done so far. Date: Tue, 18 Sep 2001 21:37:25 -0500
This is what I have done to help resolve the issue. I had roughly 30
servers hit by this thing.
1. Download/Install latest patches for IIS 4 and 5
2. Download/Install URL Scan for www servers.
3. Remove WWW service from any system not using webservices.
4. Search and delete all *.eml files (over 60,000 found)
5. Enable Filemon (Sysinternals) on every system with filter for *.eml
6. Install Network Monitor on every server for sniffing.
7. Create "Test" share directory on systems and enable Auditing
8. Update Email Server Virus Engines (Sophos, Norton, etc...)
9. Initiate manual scan of all email.
10. Update Server Virus Engines and initiate scan.
11. Update Client Virus Engines and initiate scan.
12. Monitor servers for additional activity on Filemon.
PS. Our system was infected by a consultant that was accessing their
company website on the internet that was using the Exchange Web Client. My
users have also recieved emails that appear to be infected. If the preview
pane is enabled then it automatically attempts to download and run the
readme.exe...if you choose cancel it proceeds to kill outlook.
Also, I'm not sure all the damage has been found yet.
Thanks.
Murphy
-----Original Message-----
From: Higgins, Lyndon [mailto:lhiggins@nine.com.au]
Sent: Tuesday, September 18, 2001 8:27 PM
To: 'Murphy, Brian'; 'Marc Fossi'; Focus-MS
Subject: RE: Nimda Worm Alert (fwd)
The Internet! ie any IIS box serving up sites. We have shutdown all WWW
access (proxies etc etc) to the internet until updated virus defs can be
placed on all internal client machines, and servers patched with the URLSCAN
tool.
I suggest you may want to do the same.
Technet - URLSCAN
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/
tools/URLscan.asp
Download - URLSCAN
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=32571
Lyndon.
________________________________
L y n d o n H i g g i n s MCSE
Network & Systems Engineer
Information Systems
Nine Network Australia
P h o n e: +61 2 9965 2782
F a x: +61 2 9965 2982
E m a i l: mailto:lhiggins@nine.com.au
________________________________
-----Original Message-----
From: Murphy, Brian [mailto:admin@carterbloodcare.org]
Sent: Wednesday, 19 September 2001 7:57 AM
To: 'Marc Fossi'; Focus-MS
Subject: RE: Nimda Worm Alert (fwd)
Hey guys. This thing is copying .eml files to every share point in my
network. I have patched every IIS system. I have shut down IIS on systems
that do not require it. The files are still coming from somewhere. How do
I trace the source down???
-----Original Message-----
From: Marc Fossi [mailto:mfossi@securityfocus.com]
Sent: Tuesday, September 18, 2001 2:20 PM
To: Focus-MS
Subject: Nimda Worm Alert (fwd)
The PDF version of this alert will be posted on ARIS analyzer and
predictor shortly (http://aris.securityfocus.com,
https://aris.securityfocus.com/predictor)
Incident Analysis Alert
Version 1
September 18, 2001, 18:00 UDT
Executive Summary
-----------------
A new worm named W32/Nimda-A (known aliases are Nimda, Minda, Concept
Virus, Code Rainbow) began to proliferate the morning of September 18,
2001 on an extremely large scale. It utilizes multiple IIS
vulnerabilities to propagate via the web, and Outlook and Outlook Express
vulnerabilities to distribute itself through email. It spreads through
three different means; as an email attachment, a web defacement download,
and by directly targeting machines by exploiting known IIS vulnerabilities
such as the ones exploited by Code Red and Code Blue. There has been one
report thus far of an Apache Server crashing due to Nimda terminating
httpd processes. No further corroboration has been made that this worm
may have in the inadvertent affect of creating a denial of service
condition on Apache Servers. Multiple sources have confirmed that this
worm consumes a large amount of bandwidth and impaired performance on web
servers is a result. It should be noted that this worm began to
proliferate almost exactly a week since the terrorist activities began to
take place in the United States.
Currently, anti-virus software does not detect this worm due to the recent
nature of its proliferation.
The Nimda Worm exploits the following vulnerabilities:
Microsoft IIS 4.0/5.0 File Permission Canonicalization Vulnerability
http://www.securityfocus.com/bid/1565
Microsoft IIS/PWS Escaped Characters Decoding Command Execution
Vulnerability
http://www.securityfocus.com/bid/1806
Microsoft IE MIME Header Attachment Execution Vulnerability
http://www.securityfocus.com/bid/2524
Microsoft IIS and PWS Extended Unicode Directory Traversal Vulnerability
http://www.securityfocus.com/bid/2708
Microsoft Index Server and Indexing Service ISAPI Extension Buffer
Overflow Vulnerability
http://www.securityfocus.com/bid/2880
Action Items
------------
Apply the appropriate patches listed in the 'Patches' section below. In
addition, any IIS servers still vulnerable to the Unicode hole, or that
have the root.exe backdoor present should be taken off-line until they can
be rebuilt.
Associated Vulnerability:
Microsoft IIS 4.0/5.0 File Permission Canonicalization Vulnerability
Microsoft IIS/PWS Escaped Characters Decoding Command Execution
Vulnerability
Microsoft IE MIME Header Attachment Execution Vulnerability
Microsoft IIS and PWS Extended Unicode Directory Traversal Vulnerability
Microsoft Index Server and Indexing Service ISAPI Extension Buffer Overflow
Vulnerability
Associated Bugtraq ID: 1565, 1806, 2524, 2708, 2880
Urgency: High
Ease of Exploit: Automatic
Associated Operating Systems: Microsoft Windows NT 4.0, Windows 2000
Technical Overview
------------------
This worm takes advantage of two vulnerabilities, and one backdoor. The
worm spreads via e-mail and the web. For the e-mail vector, it arrives in
the user's inbox as a message with a variable subject line. In the
e-mail, there is an attachment named readme.exe. This worm formats the
e-mail in such a way as to take advantage of a hole in older versions of
Internet Explorer. Outlook mail clients use the Internet Explorer
libraries to display HTML e-mail, so by extension Outlook and Outlook
Express are vulnerable as well, if Internet Explorer is vulnerable. The
hole allows the readme.exe program to execute automatically as soon as the
e-mail is previewed or read.
Once it has infected a new victim, it mails copies of itself to other
potential victims, and begins scanning for vulnerable IIS Web servers.
When scanning for vulnerable IIS servers, it uses both the Unicode hole as
well as trying the root.exe backdoor left by Code Red II. Once it finds a
vulnerable IIS server, it installs itself in such a way that visitors to
the now-infected web site will be sent a copy of a .eml file, which is a
copy of the e-mail that gets sent. If the victim is using Internet
Explorer as their browser, and they are vulnerable to the hole, they will
execute the readme.exe attachment in the same way as if they had viewed an
infected e-mail message.
Corroboration
-------------
Multiple Anti-Virus vendors have released an alert on this worm:
McAfee
http://vil.nai.com/vil/virusSummary.asp?virus_k=99209
Sophos
http://www.sophos.com/virusinfo/analyses/w32nimdaa.html
Symantec
http://www.symantec.com/avcenter/venc/data/w32.nimda.a@mm.html
Patches
-------
IIS Lockdown Tool
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/itsolutio
ns/security/tools/locktool.asp
Microsoft Security Bulletin MS01-020
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/
bulletin/MS01-020.asp
Microsoft Security Bulletin MS01-026
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/
bulletin/MS01-026.asp
Microsoft Security Bulletin MS01-033
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/
bulletin/MS01-033.asp
Microsoft Security Bulletin MS00-057
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/
bulletin/ms00-057.asp
Microsoft Security Bulletin MS00-078
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/
bulletin/ms00-078.asp
Attack Data
-----------
Examination of the source of the worm reveals the following attack strings
used to exploit IIS Web servers.
'/scripts/..%255c..'
'/_vti_bin/..%255c../..%255c../..%255c..'
'/_mem_bin/..%255c../..%255c../..%255c..'
'/msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%'
'/scripts/..%c1%1c..'
'/scripts/..%c0%2f..'
'/scripts/..%c0%af..'
'/scripts/..%c1%9c..'
'/scripts/..%%35%63..'
'/scripts/..%%35c..'
'/scripts/..%25%35%63..'
'/scripts/..%252f..'
To those strings are added /winnt/system32/cmd.exe?/c+dir
Other attacks include:
'/scripts/root.exe?/c+dir'
'/MSADC/root.exe?/c+dir'
Jensenne Roculan
SecurityFocus - http://www.securityfocus.com
ARIS - http://aris.securityfocus.com
(403) 213-3939 ext. 229
_________________________________________________________
Disclaimer:
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom
they are addressed.
If you have received this email in error, please notify the addressee
by return email.
This email transmission is the property of Nine Network Australia
Proprietary Limited
and any information it contains is legally protected.
This footnote also confirms the email message has been swept for the
presence of computer viruses.
__________________________________________________________
- Previous message: Anthony Michaud: "RE: Nimda Worm Alert (fwd)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
