How is Blaster caught?

  • Thread starter Thread starter Martin C.E.
  • Start date Start date
M

Martin C.E.

How is the Blaster worm caught?

I looked at http://vil.nai.com/vil/content/v_100547.htm
but I was no wiser.

A worm to me is something which propagates by email. But some tech
support guy I spoke to said that Blaster propagated just by the user
visiting a web page.

Can anyone advise me on the true way Blaster is caught.
 
How is the Blaster worm caught?

I looked at http://vil.nai.com/vil/content/v_100547.htm
but I was no wiser.

A worm to me is something which propagates by email.
Click to expand...


Someone has seriously misinformed you =)

But some tech
support guy I spoke to said that Blaster propagated just by the user
visiting a web page.
Click to expand...


Your tech support guy needs shooting too!

Can anyone advise me on the true way Blaster is caught.
Click to expand...


Why does this post scream "I still haven't patched my box"? =\

It exploits the RPC DCOM process.. and as stated, it catches you!



Regards,

Ian
 
Martin C.E. said:
How is the Blaster worm caught?

I looked at http://vil.nai.com/vil/content/v_100547.htm
but I was no wiser.

A worm to me is something which propagates by email. But some tech
support guy I spoke to said that Blaster propagated just by the user
visiting a web page.
Click to expand...

I hope he wasn't Tech. Support for a major anti-virus company!

As someone else said, it catches you. If your system is unpatched, another
PC on the network infected with the virus will scan random IP addresses
looking for its next victim. If your system happens to be unpatched and
response to DCOM RPC requests, it'll send its packet to effictively change
the operation of DCOM RPC to server another function: listen for remote
connections.

When this remote connection comes in, it essentially commands your PC to
download and run a file. From there it continues (scanning, infecting,
executing).

-TIm
 
How is the Blaster worm caught?

I looked at http://vil.nai.com/vil/content/v_100547.htm
but I was no wiser.
Click to expand...

That description has your answer.
A worm to me is something which propagates by email.
Click to expand...

No. Not just email.
But some tech
support guy I spoke to said that Blaster propagated just by the user
visiting a web page.
Click to expand...

The support guy is wrong.
Can anyone advise me on the true way Blaster is caught.
Click to expand...

You have the answer in your post. You need more descriptions? Google
them up.

Art
http://www.epix.net/~artnpeg
 
Martin said:
How is the Blaster worm caught?
Click to expand...

computer A executes the worm... the worm sends specially crafted
traffic to computer B to exploit a buffer overrun vulnerability in the
DCOM RPC interface on computer B in order to execute a command shell (a
dos window) to launch an ftp utility to download the worm and then
execute the worm on computer B... at this point you can think of
computer B as being computer A...
I looked at http://vil.nai.com/vil/content/v_100547.htm
but I was no wiser.
Click to expand...

well it looks like all the info is there...
A worm to me is something which propagates by email. But some tech
support guy I spoke to said that Blaster propagated just by the user
visiting a web page.
Click to expand...

i would suggest you don't listen to virus information from this person
again...
 
As someone else said, it catches you. If your system is unpatched, another
PC on the network infected with the virus will scan random IP addresses
looking for its next victim...
Click to expand...

So, if the PC is scanning for IP addresses, and if your broadband connection
is running through a router, the virus will only see the router and your
computer won't be affected? (That's a question.)

Thanks.

Sheldon
(e-mail address removed)
 
Sheldon said:
So, if the PC is scanning for IP addresses, and if your broadband connection
is running through a router, the virus will only see the router and your
computer won't be affected? (That's a question.)
Click to expand...


This is correct unless your router is configured to forward the offending
ports to a PC within your network.

It is best to go ahead and patch your PCs.
 
As I said in a previous post, none of my clients with a router called me,
but I am patching computers as I go. Also, the only time I open access is
when an IT person I'm working with needs to get through, and then we always
close it when finished.

BTW, you might want to check out my FYI post. First official word from
Microsoft to its partners.

Thanks for the info.

Sheldon
(e-mail address removed)
 
As I said in a previous post, none of my clients with a router called me,
but I am patching computers as I go. Also, the only time I open access is
when an IT person I'm working with needs to get through, and then we always
close it when finished.

BTW, you might want to check out my FYI post. First official word from
Microsoft to its partners.

Thanks for the info.

Sheldon
(e-mail address removed)
 
Martin C.E. said:
How is the Blaster worm caught?

I looked at http://vil.nai.com/vil/content/v_100547.htm
but I was no wiser.
Click to expand...

It makes more sense if you have some background information
on how things work normally, like networks, computers, you
know ~ that sort of thing.
A worm to me is something which propagates by email.
Click to expand...

Some do, some don't. Some use other communications channels.
But some tech
support guy I spoke to said that Blaster propagated just by the user
visiting a web page.
Click to expand...

That's pretty sad ~ I'm glad he's not *my* tech support guy. :O)
....and he should be glad I'm not one of his customers too.
Can anyone advise me on the true way Blaster is caught.
Click to expand...

Blaster is "caught" by a computer continuing to have a vulnerability
(written by Microsoft) exposed to the network, despite the fact
that a patch for that vulnerability (also written by Microsoft) was
made available some weeks ago, and soon after the vulnerability
was first brought to their attention.

In addition to the vulnerability, some other things must be in
place (or *not* in place) for the worm to be successful in
any particular instance.
 
Juergen Nieveler said:
Ian.H said:
It exploits the RPC DCOM process.. and as stated, it catches you!
Click to expand...

To be more precise, it works like this:

1) The attacking machine sends a packet to port 135/TCP on the victims'
PC that crashes RPC through a buffer overflow[0] that leads to a
special piece of code being executed on the victim's machine.

2) Said code will open a command shell accessible via port 4444/TCP

3) The attacking PC will send a sequence of commands to the victim:
3.1) Download msblast.exe from $attacker with TFTP and save it in
%systemdir%
3.2) Launch msblast.exe

4) msblast.exe will launch a TFTP server on the victim machine and
start sending exploit packets to random targets.

After that, everything starts over, until the built-in payload
activates itself to flood the MS server.


[0] 80% of the time this packet is designed to take out XP, 20% of the
time Win2k, according to Symantec.
Click to expand...
Does this mean you could experience the 60 sec shutdown window, even if the
worm failed to infect your computer?
 
Eds said:
Does this mean you could experience the 60 sec shutdown window, even
if the worm failed to infect your computer?
Click to expand...

Yes, the shutdown is caused by the RPC service on XP crashing after
receiving the malformed packet. MS apparently implemented this as a
feature to make sure that machines don't suffer a DoS through malformed
RPC requests.... after all, Rebooting always solves all problems on
Windows ;-)

The only way to prevent the shutdown from happening (apart from
stopping the countdown manually) is to apply the patch so that the RPC
service doesn't crash.

BTW, I've heard that a couple of "Personal Firewalls" didn't protect
against this attack - has anybody heard more about this?
 
This explains what's happened to me, I think. I kept getting the shutdown
window, though Outpost Firewall was running. I had disabled it briefly that
day, so I thought maybe that's when I got infected, but now i think each
time I was attacked it blocked installation of the worm, but failed to
prevent the RPC crash. I haven't been able to find any sign of the worm on
my computer in any of its known variants. The MS patch has prevented the
crash reoccurring. I was worried I had an unknown variant on my PC, but
maybe Outpost did part of its job?

Not completely convinced by this, but it's a bit out of my area...

Eds
 
Juergen Nieveler said:
Yes, the shutdown is caused by the RPC service on XP crashing after
receiving the malformed packet. MS apparently implemented this as a
feature to make sure that machines don't suffer a DoS through malformed
RPC requests.... after all, Rebooting always solves all problems on
Windows ;-)

The only way to prevent the shutdown from happening (apart from
stopping the countdown manually) is to apply the patch so that the RPC
service doesn't crash.

BTW, I've heard that a couple of "Personal Firewalls" didn't protect
against this attack - has anybody heard more about this?
Click to expand...


Hi Guys.......just some confirmation from you please. My neighbour just
informed me he has Blaster........this is the same guy that sells the
huge commercial computers (grin).......he has XP and I asked him where
in hell his firewall was. He hasn't downloaded Zone Alarm or any
other......so why didn't the infamous XP firewall stop
it.......rhetorical questions I guess.

Anyway......he is crashing in about 60 seconds.......so I told him I
would download the patch and the fix to get rid of it.

Question......should I download the MS patch first and put that on?
According to Symantec, it is sometimes necessary. And as I have never
done this sort of thing on someone else's computer, I want to make sure
that I do it properly. As in......where do I direct it to go from the
floppie. Same question for the patch to get rid of Blaster. I am
woefully inadequate in the basics (G).

Plus I will no doubt be thinking "60 seconds......aarrgghh".....grin.
Shoot, I spend my time making sure I DON'T get these nasties......not
taking them off someone else's computer!!

Thanks in advance......Heather
 
Plus I will no doubt be thinking "60 seconds......aarrgghh".....grin.
Shoot, I spend my time making sure I DON'T get these nasties......not
taking them off someone else's computer!!
Click to expand...

I would put him in the driver's seat, pull up a chair and make him drive.
Goto www.microsoft.com and look under the top right link.
 
On that special day, Heather, ([email protected]) said...
Hi Guys
Click to expand...

Hi Heather. How's the power over there?
Question......should I download the MS patch first and put that on?
Click to expand...

According to Nick, you can do it that way, provided there is a reboot in
between the Patch and installing the Service Pack.
According to Symantec, it is sometimes necessary. And as I have never
done this sort of thing on someone else's computer, I want to make sure
that I do it properly.
Click to expand...

I am no XP savvy, but fixed my sister's system (well, she wasn't
infected, but needed a prophylaxe) without problems.
As in......where do I direct it to go from the
floppie. Same question for the patch to get rid of Blaster. I am
woefully inadequate in the basics (G).
Click to expand...

I copied the file from floppy to the harddisk, ran it, it checked the
system, extracted some files, copied them, initiated a reboot, and that
was it.

After that, i went into the management of services and set the RPC
service to "restart service when crashed" instead of "shutdown entire
machine when crashed"
Plus I will no doubt be thinking "60 seconds......aarrgghh".....grin.
Shoot, I spend my time making sure I DON'T get these nasties......not
taking them off someone else's computer!!
Click to expand...

You can stop the shutdown in two ways:

- Open a command line window (running cmd.exe) and enter the command
shutdown -a (at least we Germans need the parameter -a) to stop it in
its tracks.

- Go to the clock in the systray, open it and set the time back a couple
of hours. The moment for shutdown isn't calculated by time passing, as
the message seems to imply, but by the absolute time Windows has decided
to be the shutdown date.

Method 1 is courtesy to Heise Verlag (www.heise.de), the other to Robin
Socha (a notorious defendant of "good computing must be done with
Linux", close to the verge of a troll sometimes, but a LOT more
intelligent)


HTH


Gabriele Neukam

(e-mail address removed)
 
Juergen Nieveler said:
Ian.H said:
It exploits the RPC DCOM process.. and as stated, it catches you!
Click to expand...

To be more precise, it works like this:

1) The attacking machine sends a packet to port 135/TCP on the victims'
PC that crashes RPC through a buffer overflow[0] that leads to a
special piece of code being executed on the victim's machine.

2) Said code will open a command shell accessible via port 4444/TCP

3) The attacking PC will send a sequence of commands to the victim:
3.1) Download msblast.exe from $attacker with TFTP and save it in
%systemdir%
3.2) Launch msblast.exe

4) msblast.exe will launch a TFTP server on the victim machine and
start sending exploit packets to random targets.

After that, everything starts over, until the built-in payload
activates itself to flood the MS server.


[0] 80% of the time this packet is designed to take out XP, 20% of the
time Win2k, according to Symantec.
Click to expand...

So there is no concern for windows 98 (SE)?

Alex
 
Back
Top