[News] Sasser worm might bug PCs for years

T

Tech Zero

From TheStar.com: http://tinyurl.com/2yf3w

LONDON—The rapidly evolving Sasser worm tore across the Internet
yesterday to claim new victims, particularly among home computer users.

First detected over the weekend, the worm has already infected, by some
estimates, more than 1 million personal computers running on Microsoft
Windows 2000, NT and XP operating systems. Four variants have emerged.

Among its victims are banks, travel-booking systems, European
Commission offices and Britain's 19 coast guard stations.

"We've had to go back to plotting on paper charts rather than using the
computer mapping system," a spokesperson for Britain's Maritime and
Coastguard Agency said.

Unlike most previous Internet outbreaks, Sasser infects vulnerable PCs
without any action by the user like opening attachments, allowing it to
spread quickly. Computer worms tend to spread faster than the typical
e-mail-borne virus since they are usually programmed to continuously
scan the Internet's global network to hunt for PCs to infect.

Experts said while corporate network technicians had by and large moved
to block its further spread yesterday, infection among home users was
spreading.

"Among corporate computer users, the impact has dropped off because
network administrators have taken time to put patches in place," said
Joe Hartmann, director of the virus research group for Trend Micro Inc.
in Cupertino, Calif.

"That's not true for many home computer users, where this virus can
spread exponentially," Hartmann said. "I don't think this virus has
reached its full potential yet."

"It will be a big problem for a day or two, and then it will linger on
the Internet for weeks, and likely years," said Mikko Hypponen of
Finnish data security firm F-Secure Corp.
 
J

John Coutts

This worm should not have infected anyone on a network that is run properly.
When the RPC vulnerabilty was discoverd quite some time ago, Cisco strongly
advised blocking port 445 and the netbios ports at the network perimeter. Any
network so protected would not be bothered by this worm.

J.A. Coutts
************* REPLY SEPARATER **************
 
D

Dr.X

Tech Zero said:
From TheStar.com: http://tinyurl.com/2yf3w ....
"We've had to go back to plotting on paper charts rather than using the
computer mapping system," a spokesperson for Britain's Maritime and
Coastguard Agency said.
....

Wch leads to the question:
Why the f**k are they using Winblows machines without properly firewalling
them?!?!?

Dr.X, a happy windows user ;-)
 
T

Tech Zero

The voice of "John Coutts" drifted in on the cyber-winds,
from the sea of virtual chaos...
This worm should not have infected anyone on a network that is run
properly. When the RPC vulnerabilty was discoverd quite some time
ago, Cisco strongly advised blocking port 445 and the netbios
ports at the network perimeter. Any network so protected would not
be bothered by this worm.


I'm seeing three port hits from this viral...
2004/05/05 11:08:10.50 I 209.115.159.179 4204 209.115.159.139 445
2004/05/05 11:08:13.41 I 209.115.159.179 4003 209.115.159.139 135
2004/05/05 11:08:13.41 I 209.115.159.179 4038 209.115.159.139 1025
2004/05/05 11:08:13.41 I 209.115.159.179 4204 209.115.159.139 445
2004/05/05 11:08:19.39 I 209.115.159.179 4038 209.115.159.139 1025
2004/05/05 11:08:19.39 I 209.115.159.179 4003 209.115.159.139 135
2004/05/05 11:19:47.89 I 209.115.159.220 3884 209.115.159.139 445
2004/05/05 11:30:57.70 I 209.115.159.179 3929 209.115.159.139 135
2004/05/05 11:31:22.09 I 209.115.216.192 1229 209.115.159.139 445
2004/05/05 11:31:25.06 I 209.115.216.192 1229 209.115.159.139 445
2004/05/05 11:44:17.69 I 209.115.159.179 4931 209.115.159.139 1025

My logs are full of similar examples...
But I'm not sure if ports "1025" & "135" are being sent by the viral,
or someting else on the infected computer.
 
J

Jason Wade

[ snippedy do-dah ]
2004/05/05 11:30:57.70 I 209.115.159.179 3929 209.115.159.139 135
2004/05/05 11:31:22.09 I 209.115.216.192 1229 209.115.159.139 445
2004/05/05 11:31:25.06 I 209.115.216.192 1229 209.115.159.139 445
2004/05/05 11:44:17.69 I 209.115.159.179 4931 209.115.159.139 1025

My logs are full of similar examples...
But I'm not sure if ports "1025" & "135" are being sent by the viral,
or someting else on the infected computer.

Isn't there a way to tell what type of virus it
is by looking at certain things in the packets?

I remember hearing that one software firewall
company (I don't remember which) claimed to do that.
 
I

Ian Kenefick

Actually,

Internet traffic watchers reported probes looking for MS04-011
vulnerable PC's on the on and before the 15th April....

Interestingly enough TCP 445 is also associated with e ASM.1
vulnerability........

Ian.
 
J

John Coutts

My logs are full of similar examples...
But I'm not sure if ports "1025" & "135" are being sent by the viral,
or someting else on the infected computer.
********************* REPLY SEPARATER ***********************
All the information that I have been able to gather to date indicates that TCP
port 445 is used to seed the virus to random IP addresses. Our main router
stats tend to support that:
deny udp any any range 135 139 (19443 matches)
deny tcp any any range 135 139 (5416 matches)
deny tcp any any eq 445 (210410 matches)
in the past 22 hours

J.A. Coutts
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top