237 lines
11 KiB
Plaintext
237 lines
11 KiB
Plaintext
|
**********************************************************************
|
|||
|
|
|
|||
|
|
DDN Security Bulletin 03 DCA DDN Defense Communications System
|
|||
|
|
18 Oct 89 Published by: DDN Security Coordination Center
|
|||
|
|
(SCC@NIC.DDN.MIL) (800) 235-3155
|
|||
|
|
|
|||
|
|
DEFENSE DATA NETWORK
|
|||
|
|
SECURITY BULLETIN
|
|||
|
|
|
|||
|
|
The DDN SECURITY BULLETIN is distributed by the DDN SCC (Security
|
|||
|
|
Coordination Center) under DCA contract as a means of communicating
|
|||
|
|
information on network and host security exposures, fixes, & concerns
|
|||
|
|
to security & management personnel at DDN facilities. Back issues may
|
|||
|
|
be obtained via FTP (or Kermit) from NIC.DDN.MIL [26.0.0.73 or
|
|||
|
|
10.0.0.51] using login="anonymous" and password="guest". The bulletin
|
|||
|
|
pathname is SCC:DDN-SECURITY-nn (where "nn" is the bulletin number).
|
|||
|
|
|
|||
|
|
**********************************************************************
|
|||
|
|
|
|||
|
|
W.COM ("WANK") WORM ON SPAN NETWORK
|
|||
|
|
|
|||
|
|
On 16 October, the CERT received word from SPAN network control that a
|
|||
|
|
worm was attacking SPAN VAX/VMS systems. This worm affects only DEC
|
|||
|
|
VMS systems and is propagated via DECnet (not TCP/IP) protocols.
|
|||
|
|
At least two versions of this worm exist and more may be created.
|
|||
|
|
Non-VMS systems are immune; TCP/IP networks are not at risk.
|
|||
|
|
|
|||
|
|
While this program is very similar to last year's HI.COM (or "Father
|
|||
|
|
Christmas") worm (see DDN MGT Bulletin #50 23 Dec 88), THIS IS NOT A
|
|||
|
|
PRANK. Instead of a "cute" Christmas greeting, W.COM appends code to
|
|||
|
|
.com files and displays this banner:
|
|||
|
|
|
|||
|
|
W O R M S A G A I N S T N U C L E A R K I L L E R S
|
|||
|
|
_______________________________________________________________
|
|||
|
|
\__ ____________ _____ ________ ____ ____ __ _____/
|
|||
|
|
\ \ \ /\ / / / /\ \ | \ \ | | | | / / /
|
|||
|
|
\ \ \ / \ / / / /__\ \ | |\ \ | | | |/ / /
|
|||
|
|
\ \ \/ /\ \/ / / ______ \ | | \ \| | | |\ \ /
|
|||
|
|
\_\ /__\ /____/ /______\ \____| |__\ | |____| |_\ \_/
|
|||
|
|
\___________________________________________________/
|
|||
|
|
\ /
|
|||
|
|
\ Your System Has Been Officically WANKed /
|
|||
|
|
\_____________________________________________/
|
|||
|
|
|
|||
|
|
You talk of times of peace for all, and then prepare for war.
|
|||
|
|
|
|||
|
|
Initial reports described the worm as destructive, i.e. it would erase
|
|||
|
|
files. Detailed analysis by the CERT, Lawrence Livermore National
|
|||
|
|
Laboratory, and FermiLab has not found any code that would perform
|
|||
|
|
file erasures. However, files are altered and new accounts created.
|
|||
|
|
Serious security holes are left open by this worm.
|
|||
|
|
|
|||
|
|
It is very important to understand that someone in the future could
|
|||
|
|
launch this worm on any DECnet based network. Many copies of the
|
|||
|
|
virus have been mailed around. Anyone running a DECnet network should
|
|||
|
|
be warned.
|
|||
|
|
|
|||
|
|
When the DDN PMO received these initial reports, the MailBridge
|
|||
|
|
filters were activated to preclude any traffic from passing between
|
|||
|
|
MILNET and the rest of the Internet. The filters will be turned off
|
|||
|
|
(restoring full interoperability) Tuesday 17 October 1989 NLT 17:00
|
|||
|
|
EDT. (NOTE: W.COM could traverse the MILNET only if encapsulated in
|
|||
|
|
a TCP/IP "envelope", i.e. "assisted" by a human agent, and cannot
|
|||
|
|
"infect" the MILNET.)
|
|||
|
|
|
|||
|
|
R. Kevin Oberman from Lawrence Livermore National Laboratory reports:
|
|||
|
|
|
|||
|
|
"This is a mean bug to kill and could have done a lot of damage.
|
|||
|
|
Since it notifies (by mail) someone of each successful penetration
|
|||
|
|
and leaves a trapdoor (the FIELD account), just killing the bug is
|
|||
|
|
not adequate. You must go in an make sure all accounts have
|
|||
|
|
passwords and that the passwords are not the same as the account
|
|||
|
|
name."
|
|||
|
|
|
|||
|
|
The CERT also suggests checking every .com file on the system. The
|
|||
|
|
worm appends code to .com files which will reopen a security hole
|
|||
|
|
every time the program is executed.
|
|||
|
|
|
|||
|
|
An analysis of the worm (provided by R. Kevin Oberman and used with
|
|||
|
|
his permission) appears below. Included with the analysis is a DCL
|
|||
|
|
program that will block the current version of the worm. This program
|
|||
|
|
should provide enough time to close up obvious security holes.
|
|||
|
|
|
|||
|
|
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
|||
|
|
|
|||
|
|
Date: Mon, 16 Oct 89 15:30 PDT
|
|||
|
|
From: "Kevin Oberman, LLNL, (415)422-6955" <OBERMAN@icdc.llnl.gov>
|
|||
|
|
Subject: Report on network worm ***URGENT***
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
Report on the W.COM worm.
|
|||
|
|
R. Kevin Oberman
|
|||
|
|
Engineering Department
|
|||
|
|
Lawrence Livermore National Laboratory
|
|||
|
|
October 16, 1989
|
|||
|
|
|
|||
|
|
The following describes the action of the W.COM worm (currently based on the
|
|||
|
|
examination of the first two incarnations). The replication technique causes
|
|||
|
|
the code to be modified slightly which indicates the source of the attack and
|
|||
|
|
learned information.
|
|||
|
|
|
|||
|
|
All analysis was done with more haste than I care for, but I believe I have all
|
|||
|
|
of the basic facts correct.
|
|||
|
|
|
|||
|
|
First a description of the program:
|
|||
|
|
|
|||
|
|
1. The program assures that it is working in a directory to which the owner
|
|||
|
|
(itself) has full access (Read, Write,Execute, and Delete).
|
|||
|
|
|
|||
|
|
2. The program checks to see if another copy is still running. It looks for a
|
|||
|
|
process with the first 5 characters of "NETW_". If such is found, it deletes
|
|||
|
|
itself (the file) and stops its process.
|
|||
|
|
|
|||
|
|
NOTE
|
|||
|
|
A quick check for infection is to look for a process name starting with
|
|||
|
|
"NETW_". This may be done with a SHOW PROCESS command.
|
|||
|
|
|
|||
|
|
3. The program then changes the default DECNET account password to a random
|
|||
|
|
string of at least 12 characters.
|
|||
|
|
|
|||
|
|
4. Information on the password used to access the system is mailed to the user
|
|||
|
|
GEMTOP on SPAN node 6.59. Some versions may have a different address.
|
|||
|
|
|
|||
|
|
5. The process changes its name to "NETW_" followed by a random number.
|
|||
|
|
|
|||
|
|
6. It then checks to see if it has SYSNAM priv. If so, it defines the system
|
|||
|
|
announcement message to be the banner in the program:
|
|||
|
|
W O R M S A G A I N S T N U C L E A R K I L L E R S
|
|||
|
|
_______________________________________________________________
|
|||
|
|
\__ ____________ _____ ________ ____ ____ __ _____/
|
|||
|
|
\ \ \ /\ / / / /\ \ | \ \ | | | | / / /
|
|||
|
|
\ \ \ / \ / / / /__\ \ | |\ \ | | | |/ / /
|
|||
|
|
\ \ \/ /\ \/ / / ______ \ | | \ \| | | |\ \ /
|
|||
|
|
\_\ /__\ /____/ /______\ \____| |__\ | |____| |_\ \_/
|
|||
|
|
\___________________________________________________/
|
|||
|
|
\ /
|
|||
|
|
\ Your System Has Been Officically WANKed /
|
|||
|
|
\_____________________________________________/
|
|||
|
|
|
|||
|
|
You talk of times of peace for all, and then prepare for war.
|
|||
|
|
|
|||
|
|
7. If it has SYSPRV, it disables mail to the SYSTEM account.
|
|||
|
|
|
|||
|
|
8. If it has SYSPRV, it modifies the system login command procedure to
|
|||
|
|
APPEAR to delete all of a user's file. (It really does nothing.)
|
|||
|
|
|
|||
|
|
9. The program then scans the accounts logical name table for command
|
|||
|
|
procedures and tries to modify the FIELD account to a known password
|
|||
|
|
with login from any source and all privs. This is a primitive virus,
|
|||
|
|
but very effective IF it should get into a privileged account.
|
|||
|
|
|
|||
|
|
10. It proceeds to attempt to access other systems by picking node numbers at
|
|||
|
|
random. It then used PHONE to get a list of active users on the remote system.
|
|||
|
|
It proceeds to irritate them by using PHONE to ring them.
|
|||
|
|
|
|||
|
|
11. The program then tries to access the RIGHTSLIST file and attempts
|
|||
|
|
to access some remote system using the users found and a list of
|
|||
|
|
"standard" users included with the worm. It looks for passwords
|
|||
|
|
which are the same as that of the account or are blank. It records all
|
|||
|
|
such accounts.
|
|||
|
|
|
|||
|
|
12. It looks for an account that has access to SYSUAF.DAT.
|
|||
|
|
|
|||
|
|
13. If a priv. account is found, the program is copied to that account and
|
|||
|
|
started. If no priv account was found, it is copied to other accounts found on
|
|||
|
|
the random system.
|
|||
|
|
|
|||
|
|
14. As soon as it finishes with a system, it picks another random system and
|
|||
|
|
repeats (forever).
|
|||
|
|
|
|||
|
|
Response:
|
|||
|
|
|
|||
|
|
1. The following program will block the worm. Extract the following code
|
|||
|
|
and execute it. It will use minimal resources. It create a process named
|
|||
|
|
NETW_BLOCK which will prevent the worm from running.
|
|||
|
|
-------
|
|||
|
|
Editors note: This fix will work only with this version of the worm.
|
|||
|
|
Mutated worms will require modification of this code; however, this
|
|||
|
|
program should prevent the worm from running long enough to secure
|
|||
|
|
your system from the worms attacks.
|
|||
|
|
-------
|
|||
|
|
==============================================================================
|
|||
|
|
$ Set Default SYS$MANAGER
|
|||
|
|
$ Create BLOCK_WORM.COM
|
|||
|
|
$ DECK/DOLLAR=END_BLOCK
|
|||
|
|
$LOOP:
|
|||
|
|
$ Set Process/Name=NETW_BLOCK
|
|||
|
|
$ Wait 12:0
|
|||
|
|
$ GoTo loop
|
|||
|
|
END_BLOCK
|
|||
|
|
$ Run/Input=SYS$MANAGER:BLOCK_WORM.COM/Error=NL:/Output=NL:/UIC=[1,4] -
|
|||
|
|
SYS$SYSTEM:LOGINOUT
|
|||
|
|
==============================================================================
|
|||
|
|
|
|||
|
|
2. Enable security auditing. The following command turns on the MINIMUM
|
|||
|
|
alarms. The log is very useful in detecting the effects of the virus left by
|
|||
|
|
the worm. It will catch the viruses modification of the UAF.
|
|||
|
|
$ Set Audit/Alarm/Enable=(ACL,Authorization,Breakin=All,Logfailure=All)
|
|||
|
|
|
|||
|
|
3. Check for any account with NETWORK access available for blank passwords or
|
|||
|
|
passwords that are the same as the username. Change them!
|
|||
|
|
|
|||
|
|
4. If you are running VMS V5.x, get a copy of SYS$UPDATE:NETCONFIG_UPDATE.COM
|
|||
|
|
from any V5.2 system and run it. If you are running V4.x, change the username
|
|||
|
|
and password for the network object "FAL".
|
|||
|
|
|
|||
|
|
5. If you have been infected, it will be VERY obvious. Start checking the
|
|||
|
|
system for modifications to the FIELD account. Also, start scanning the system
|
|||
|
|
for the virus. Any file modified will contain the following line:
|
|||
|
|
$ oldsyso=f$trnlnm("SYS$OUTPUT")
|
|||
|
|
It may be in LOTS of command procedures. Until all copies of the virus are
|
|||
|
|
eliminated, the FIELD account may be changed again.
|
|||
|
|
|
|||
|
|
6. Once you are sure all of the holes are plugged, you might kill off
|
|||
|
|
NETW_BLOCK. (And then again, maybe not.)
|
|||
|
|
|
|||
|
|
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
|||
|
|
|
|||
|
|
If you have any technical questions or have an infected system, please
|
|||
|
|
call the CERT:
|
|||
|
|
|
|||
|
|
Computer Emergency Response Team
|
|||
|
|
Email: cert@sei.cmu.edu
|
|||
|
|
Telephone: 412-268-7090 (answers 24 hours a day)
|
|||
|
|
|
|||
|
|
|
|||
|
|
If you have any general questions, please call the SCC:
|
|||
|
|
|
|||
|
|
Security Coordination Center
|
|||
|
|
Email: scc@nic.ddn.mil
|
|||
|
|
Telephone: 1-800-235-3155 or 415-859-3695 (7 a.m. to 5 p.m. Pacific time).
|
|||
|
|
|
|||
|
|
**********************************************************************
|
|||
|
|
|
|||
|
|
Downloaded From P-80 International Information Systems 304-744-2253
|