Re: Router Worm?

[Fred Laxton]

I just saw the same thing on my web server log from last night. It did
no damage, but I blocked the offending IP anyway, it can't be anything
good ;-) I also reported it to the network's abuse address.

Fred

Chris Strom wrote:

>
> I've received a strange HTTP request on my web site from two different sources. The request is logged as:
>
> SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\x b1\x02\xb1\x02\xb1\x02
> \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\x b1\x02\xb1\x02\xb1\x02\xb1\x02
> \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\x b1\x02\xb1\x02\xb1\x02\xb1\x02
> \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\x b1\x02\xb1\x02\xb1\x02\xb1\x02
> \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\x b1\x02\xb1\x02\xb1\x02\xb1\x02
> \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\x b1\x02\xb1\x02\xb1\x02\xb1\x02
> \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\x b1\x02\xb1\x02\xb1\x02\xb1\x02
> \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\x b1\x02\xb1\x02\xb1\x02\xb1\x02
> \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\x b1\x02\xb1\x02\xb1\x02\xb1\x02
>

--


--
Fred Laxton

InfoTechDesign.net - Classic Web Design & Hosting
http://infotechdesign.net

Powered by Mac OS X, Red Hat Linux, Yellow Dog Linux and Mandrake Linux
Registered Linux user #246414

[Niels Bakker]

* cstrom@cos.com (Chris Strom) [Wed 19 Nov 2003, 22:45 CET]:
>
> I've received a strange HTTP request on my web site from two different sources. The request is logged as:
>
> SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\x b1\x02\xb1\x02\xb1\x02
> \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\x b1\x02\xb1\x02\xb1\x02\xb1\x02
[..]
>
> The request continues for a total of 32732 characters long (not shown). I was able to access one of the sites on port 80, here's the server response.
>
> Date: Tue, 15 Mar 1966 05:03:04 GMT
> Server: Allegro-Software-RomPager/2.10
> Content-Type: text/html
> Last-Modified: Mon, 25 May 1998 00:00:00 GMT
> Client-Date: Wed, 19 Nov 2003 14:07:57 GMT
> Client-Peer: xxx.xxx.xxx.xxx:80
> Client-Response-Num: 1
> Title: Netopia Router (192.168.1.1)
>
> Apologies if this is a known issue or if this is the wrong forum for this information.

The host behind this NAT device is probably infected with some windows worm.


-- Niels.

[Jay Jacobson]

On Wed, 19 Nov 2003, Chris Strom wrote:

>
>
> I've received a strange HTTP request on my web site from two different sources. The request is logged as:
>
> SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\x b1\x02\xb1\x02\xb1\x02
[snip]
> The request continues for a total of 32732 characters long (not shown).
[snip]


Hi Chris. This is an IIS WebDAV exploit. For more information, check out:

http://edgeos.com/threats/details.php?id=11413
http://www.fatelabs.com/library/fatelabs-ntdll-analysis.pdf

~Jay

...
... Jay Jacobson
... Edgeos, Inc. - 480.961.5996 - http://www.edgeos.com
...
... Managed Vulnerability Assessment
... Services for Information Security Professionals
...

[Jay D. Dyson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, 19 Nov 2003, Chris Strom wrote:

> I've received a strange HTTP request on my web site from two different
> sources. The request is logged as:
>
> SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\x b1\x02\xb1\x02\xb1\x02
<snip of 32K attack signature>

I've seen much the same here on all of my web servers. I have in
excess of one megabyte of these attack signatures in my logs. Some of
them are one-time attacks; others are "burst" attacks and come one after
another for several minutes.

Haven't bothered looking into what the culprit is yet, but am
interested to learn what's at the heart of this log-bloater. In the
meantime, I'm blocking the offending IP addresses that spew this junk.

- -Jay

( ( _______
)) )) .-"There's always time for a good cup of coffee"-. >====<--.
C|~~|C|~~| (>----- Jay D. Dyson -- jdyson@treachery.net -----<) | = |-'
`--' `--' `--- Next time let's screw it up my way first ---' `------'

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (TreacherOS)
Comment: See http://www.treachery.net/~jdyson/ for current keys.

iD8DBQE/u/DoxdMhRVezQfcRAm7fAJ99WWsLh4ScPJduM/V95XaFNgwO8gCghnXL
8hr1V4xAd6yXQ+yyyS+qg4c=
=w9ru
-----END PGP SIGNATURE-----

[Jose Nazario]

its welchia/nachi. when it can't connect via 135/tcp, it will attempt an
exploit against a webdav server (see MS03-007).

i've seen an uptick in this in the past couple of days, too, visible on a
few httpd servers i track. and i, too, was caught off guard until someone
pointed out it was nachi to me. digging into the tech details showed that
i (and many of us) had been overlooking a secondary attack.

___________________________
jose nazario, ph.d. jose@monkey.org
http://monkey.org/~jose/

[David Gillett]

I've never seen it do that, in the about 50 or so instances
I've encountered. Does it only do it occasionally? Does it
attack the same host against which 135/tcp failed, or some
random third party?
(Does it, perhaps, distinguish between 135/tcp "failed to
connect" and 135/tcp "connected, but target was patched and
so could not be infected"?)

David Gillett


> -----Original Message-----
> From: Jose Nazario [mailto:jose@monkey.org]
> Sent: November 19, 2003 17:06
> To: Jay D. Dyson
> Cc: Bugtraq
> Subject: Re: Router Worm?
>
>
> its welchia/nachi. when it can't connect via 135/tcp, it will
> attempt an
> exploit against a webdav server (see MS03-007).
>
> i've seen an uptick in this in the past couple of days, too,
> visible on a
> few httpd servers i track. and i, too, was caught off guard
> until someone
> pointed out it was nachi to me. digging into the tech details
> showed that
> i (and many of us) had been overlooking a secondary attack.
>
> ___________________________
> jose nazario, ph.d. jose@monkey.org
> http://monkey.org/~jose/
>