Re: DoS worm

From: Nick FitzGerald (nick_at_virus-l.demon.co.uk)
Date: 10/21/04

  • Next message: Thomas Hochstein: "Re: Systems compromised with ShellBOT perl script - part 2" 
    Date: Thu, 21 Oct 2004 17:58:07 +1300
To: David Gillett <gillettdavid@fhda.edu>, incidents@securityfocus.com

    David Gillett wrote:

    <<snip>>
    > 3. Probe random addresses in our Class B space (port 445, CIFS);
    > if it got a connection, it tried various SMB-type things amongst
    > which I was able to pick out the string "IPC". Five other machines
    > in our space eventually demonstrated similar symptoms.
    >
    > I don't know what this beast is. I infer that #2 is a DoS attack
    > which is perhaps the purpose of the worm, and that #3 is its spread
    > vector via the IPC$ share.
    >
    > Anybody recognize this?

    One of several relatively common worms that spread via simple CIFS
    password bruteforcing (possibly among other things...). The boxes that
    were "hacked" will have had (mainly) trivial administrator passwords of
    the "admin", "qwerty", "12345", "aaaaa", etc varieties.

    Just more evidence of why the LAN should normally be treated as a
    hostile network unless you have smartly managed switches with MAC-level
    access and network configuration control. With the right equipment and
    a bit of thought you can easily set things so "unknown" machines either
    get no netwrok access at all, or are stuck into a very limited VLAN
    with very limited off-site access via the border firewalls. Sadly,
    such configurations are not that common due to a lack of will or
    expertise or <insert preferred cause celebre>.

    Regards,

    Nick FitzGerald

  • Next message: Thomas Hochstein: "Re: Systems compromised with ShellBOT perl script - part 2"