RE: cuebot-d infection method

From: Jason Burton (jab_at_leximedia.net)
Date: 08/25/05

  • Next message: Jayson Anderson: "Re: cuebot-d infection method" 
    To: <incidents@securityfocus.com>
Date: Thu, 25 Aug 2005 11:13:38 -0400

     Something w/MS Technologies. Ie. ISA Server (2004+) I believe, have whats
    called VPN Quarantine. Which allows you to check and limit access based on
    ie. If the user has proper virus definitions etc. before they get full
    access to your network.

    Just something I thought Id add. ---

    Jason

    -----Original Message-----
    From: Irwan Ismail [mailto:irwan.ismail@gmail.com]
    Sent: Thursday, August 25, 2005 12:40 AM
    To: Matt Stockdale
    Cc: jeff@jeffbryner.com; incidents@securityfocus.com
    Subject: Re: cuebot-d infection method

    I think you should know that blocking ports at the firewall isn't enough
    anymore these days. With VPNs and remote access, your teleworker & mobile
    users can easily get infected at home (or wherever they may be) while
    there's an open path directly into your organization.

    On 8/25/05, Matt Stockdale <mstockda@logicworks.net> wrote:
    > Jeff -
    >
    > I've just cleaned up four machines here, all Windows 2000. We're
    > scratching our heads, as the "published" propagation method is over
    > port 445, which wasn't open on the firewall.
    >
    > We suspect it may have come through the client's VPN access, or
    > maybe someone wrapped this backdoor in another exploit for delivery.
    >
    > Thanks,
    > Matt
    >
    > On Wed, 2005-08-24 at 12:03, Jeff Bryner wrote:
    > > I've seen a couple cuebot-d infections over the last couple days and
    > > am trying to track down the source of them. Has anyone seen enough
    > > of this to know the universe of ways the pc gets initially infected?
    > >
    > > The pcs that have gotten infected have mcafee running on them which
    > > incorrectly picks it up as W32/Sdbot.worm.gen.by when a scan is
    > > requested. It didn't seem to pick it up *until* a scan was requested.
    > >
    > > The writeup at
    > > http://www.sophos.com/virusinfo/analyses/w32cuebotd.html
    > > fits the scenario, but it doesn't say exactly what the initial
    > > infection vector is.
    > >
    > > Thanks for any help.
    > >
    > > Jeff
    > > CISSP, GCIH, GCFA
    > >
    > >
    >

  • Next message: Jayson Anderson: "Re: cuebot-d infection method"

    Relevant Pages

    • Re: vpn cant access shares
      ... jeff stated, ... "System error 5 has occurred. ... Is there a firewall active on the Linksys? ... Test it with setting up RRAS on a Windows server as a VPN serve and allow ...
      (microsoft.public.windows.server.networking)
    • RE: Sandboxing
      ... the 3Com Embedded Firewall would be extremely useful and enabling (in ... your case) when you look at it in a VPN context. ... This security policy will accomplish quite a few things: ... During the Policy Server installation, ...
      (Focus-IDS)
    • Re: Hardening an ISA Server
      ... He sets up his reverse connection server to listen on port ... the spread of the infection is at least mitigated. ... and then cracks the local administrator password. ... access to internal resources as a normal configuration, through a firewall. ...
      (microsoft.public.isa)
    • Re: Sickening.............
      ... >> If you have not used a firewall and some form of antivirus from the ... > is absolutely neccessary after viral infection. ... that connection. ...
      (microsoft.public.windowsxp.general)
    • Re: VPN Firewall for new webserver
      ... > I'm setting up a webserver at a colocation and I need to put a VPN ... You're not going to get a quality firewall for that amount, ... and D-Link makes a DI-804HV unit ... users access to the SQL server, let them do it through a VPN session. ...
      (comp.security.firewalls)