Hysterical first technical alert from US-CERT

[Larry Seltzer]

I just got the alert below from US-CERT. It's one of the new lists they =
started. Some
things about it bother me.

First, it's dated 1/28, the day MyDoom.B was discovered, and the message =
sent field says
that too; other dates in the headers disagree.=20

Second, and more to the point, it takes an extreme view of MyDoom.B that =
nobody else is
supporting, including the sources they cite. MyDoom.B is a flop.

Am I misreading something? Did anyone else get this on 1/28?

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
larryseltzer@ziffdavis.com=20

-----Original Message-----
From: CERT Advisory [mailto:cert-advisory@cert.org]=20
Sent: Wednesday, January 28, 2004 7:12 PM
To: US-CERT Community:
Subject: US CERT Technical Alert TA04-028A MyDoom.B Rapidly Spreading




-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


MyDoom.B Rapidly Spreading

Mydoom.B is a new variant of the Mydoom worm and is about 29,184
bytes. This variant attempts to perform a Distributed Denial of
Service (DDoS) attack against Microsoft.com. Details regarding this
new worm are still emerging, but it has been validated as spreading =
in
the wild. Facts about the worm will be further qualified with follow
up reports following this initial analysis.

For the latest information about this worm from US-CERT, readers are
encouraged to visit =
http://www.us-cert.gov/cas/techalerts/TA04-028A.html.

E-mails sent out by Mydoom.B are highly randomized. The From address
may be spoofed to include one of the following domains: aol.com,
msn.com, yahoo.com and hotmail.com. A randomized string value may =
then
be combined with these to generate new e-mails. This may result in
overload e-mail servers with many false addresses and auto-replies
associated with such traffic.

The subject is randomized to include one of the following
following:

* Delivery Error
* hello
* Error
* Mail Delivery System
* Mail Transaction Failed
* Returned mail
* Server Report
* Status
* Unable to deliver the message

The subject may also contain randomized data as seen in a recent live
sample: "RE: I still love you fLctv".

The message body is also randomized to include one of the
following:

* RANDOMIZED CHARACTERS
* test
* The message cannot be represented in 7-bit ASCII encoding and has
been sent as a binary attachment.
* sendmail daemon reported: Error #804 occured during SMTP session.
Partial message has been received.
* The message contains Unicode characters and has been sent as a
binary attachment.
* The message contains MIME-encoded graphics and has been sent as a
binary attachment.
* Mail transaction failed. Partial message is available.

The attachments have a randomized filename selected from one of the
following string values:

* body
* doc
* text
* document
* data
* file
* readme
* message

The randomized string value is then combined with a randomized
extension: .exe, .bat, .scr, .cmd or .pif. If the malicious =
attachment
is executed, it then opens notepad.exe and displays garbled data
(binary).

Once executed, the worm attempts to create the following files in the
Windows System directory: explorer.exe and dtfmon.dll. The Windows
registry is then modified to run the worm in memory upon Windows
startup:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Explorer=3DC:WINDOWS SYSTEM DIRECTORY\explorer.exe

The DLL component is associated with a backdoor feature of this worm.
It is likely that this Trojan worms like the one in Mydoom.A. It =
scans
through a range of TCP addresses looking for inbound TCP traffic.
Inbound TCP traffic can be used to configure the infected computer as
a proxy computer or to install code of choice on the infected
computer. More importantly, attackers are already working on tools to
hijack Mydoom infected computers to install code of choice.

The DDoS attack of Mydoom.B is against www.microsoft.com. There is
information claiming that it may also be directed at sco.com, but =
this
is unsubstantiated at this time. It appears that the more credible
data is that it only performs a DDoS attack against =
www.microsoft.com,
though a previosu version of the virus is confirmed to attack SCO.

To spread over the KaZaA P2P network, Mydoom.B creates copies of
itself in the KaZaA shared directory with randomized filenames.
Filenames include:

* attackXP-1.26
* BlackIce_Firewall_Enterpriseactivation_crack
* MS04-01_hotfix
* NessusScan_pro
* icq2004-final
* winamp5
* xsharez_scanner
* zapSetup_40_148

A randomized extension is then added to the filename selected above,
being .exe, .scr, .pif or .bat.

Mydoom.B attempts to harvest e-mails from Temporary Internet files as
well as via randomized e-mails aforementioned. It does not include =
any
e-mails containing the following strings: abuse, accoun, certific,
listserv, ntivi, icrosoft, admin, page, the.bat, gold-certs, feste,
submit, help, service, privacy, somebody, soft, contact, site, =
rating,
bugs, your, someone, anyone, nothing, nobody, noone, webmaster,
postmaster, support, samples, info, root, ruslis, nodomai, mydomai,
example, inpris, borlan, nai., sopho, foo., .mil, gov., .gov, panda,
icrosof, syma, kasper, mozilla, utgers.ed, tanford.e, acketst, secur,
isc.o, isi.e, ripe., arin., sendmail, rfc-ed, ietf, iana, usenet,
fido, linux, kernel, google, ibm.com, fsf., mit.e, math, unix,
berkeley and spam.

Mydoom.B also opens TCP port 10080. The worm contains the following
string: "sync-1.01; andy; I'm just doing my job, nothing personal,
sorry".

Alias: Mydoom, Novarg, Mydoom.B

Sources:

F-Secure Corp. (http://www.f-secure.com/v-descs/mydoom_b.shtml),
Jan. 28, 2004

Bit Defender
=
(http://www.bitdefender.com/bd/site/virusinfo.php?menu_id=3D1&v_id=3D186)=
,=20
Jan. 28, 2004

iDEFENSE Intelligence Operations, Jan. 28, 2004 Sensible Security
Solutions Inc. (http://www.sss.ca/), Jan. 28, 2004

According to iDEFENSE, this new variant of Mydoom appears to have
different MIMI data for malicious e-mails. The content type appears =
to
be plain text and includes a ZIP extension. Mydoom.A had a content
type of application/octet-stream and multipart/mixed data. It is
likely that this newest variant of Mydoom will become very widespread
in the wild. The first variant had well over 3M interceptions by just
two sources in the first 18 hours of the outbreak.

Look for questionable files about 29,184 bytes. Look for notepad.exe
to be opened, displaying binary data (garbled text). Also look for =
the
Windows registry created by the worm.

Recovery: Remove all files and the Windows registry key modifications
associated with this malicious code threat. Restore corrupted or
damaged files with clean backup copies.

Workaround: Configure e-mail servers and workstations to block file
types commonly used by malicious code to spread to other computers.
Block ZIP and executable extensions on the gateway and groupware
level. Also monitor traffic on the network and block ports associated
with Mydoom, especially inbound TCP ports for the backdoor Trojan
component and the outbound TCP 10080 port data. Administrators may
also find value in monitoring traffic associated with the DDoS
component. Carefully manage all new files, scanning them with updated
anti-virus software using heuristics prior to use.

Vendor Fix: Anti-virus vendors will likely release updated signature
files to protect against this malicious code in the near future. Some
anti-virus applications may detect this malicious code heuristically.

Name of Malicious Code: Mydoom.B
Aliases:
Mydoom.B
Mydoom
Novarg
Size in Bytes: 29184
Subjects: RE: I still love you fLctv
Body: Error 551: We are sorry your UTF-8 encoding is not supported
by the server, so the text was automatically zipped and attached to
this message.
Attachments: message.zip

This document was developed based on material contributed by =
iDEFENSE.
Our thanks for their contribution.

Last updated January 28, 2004
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFAGEufXlvNRxAkFWARAjEOAJ92cfCtcUVX+/6CGoRwGj7mIbxhzQCg0mdJ
/ip1ThurA7opfYb0JUET2UI=3D
=3Dj+iB
-----END PGP SIGNATURE-----

[Valdis.Kletnieks@vt.edu]

--==_Exmh_1073267199P
Content-Type: text/plain; charset=us-ascii

On Wed, 04 Feb 2004 09:41:39 EST, Larry Seltzer said:

> The advisory specifically says that MyDoom.B is spreading rapidly, and that was never
> the case. It didn't say that it *could* spread rapidly. Maybe you think misinforming in
> order to induce caution is a good idea, but I expect nothing but the truth from an
> agency like this.

And I posted a heads-up to our local staff about Dumaru a lot quicker than
I did for MyDoom, because from where *I* was, I saw a *huge* initial spike
of Dumaru. If I had waited, I would have realized that Dumaru had fizzled.
On the other hand, if I had waited that long and it took off like MyDoom,
we'd have been screwed.

As I said - would you rather they delayed 12 or 18 hours to identify
*for sure* how fast it was spreading? Read Nick Weaver's work on
Warhol Worms at http://www.cs.berkeley.edu/~nweaver/warhol.html and then
ask yourself how much time they should wait and verify before releasing.

Unless you have *proof* that they already *knew* it was a snoozer when
they hit send, or you have *specific* recommendations on how they can
do better, let it slide.

Or alternatively, what would *YOU* do if your boss at Ziff Davis told you that
there were cases where your article *had* to be on the web server *within an
hour* of you getting the first hint of the story, or real damage might happen?
Oh, and you don't know which stories those are, and which ones you can afford
to wait 2 or 3 hours and do follow-ups on first. Oh, and Ziff Davis also said
that if you screwed up and got a fact wrong, you'd hear about it from all your
readers.

If you got a lead that a massive DDoS was coming in 90 minutes, what would you
do?




--==_Exmh_1073267199P
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFAISelcC3lWbTT17ARAvDAAJ9twduiSXgDeBkPRxpf3W pijMKOdQCdFaby
ZK0t+/Y5ZEiD2V/gOIii2Rg=
=jwSZ
-----END PGP SIGNATURE-----

--==_Exmh_1073267199P--

[Valdis.Kletnieks@vt.edu]

--==_Exmh_1332279563P
Content-Type: text/plain; charset=us-ascii

On Tue, 03 Feb 2004 07:11:49 EST, Larry Seltzer <larry@larryseltzer.com> said:

> First, it's dated 1/28, the day MyDoom.B was discovered, and the message sent
field says
> that too; other dates in the headers disagree.

Oh, like the fact that a lot of mail servers were getting pounded by MyDoom.*A*
doesn't mean that there could be delays along the line? (Remember to add in the
timezones - at least some of the boxes are running in GMT not EST5EDT).

> Second, and more to the point, it takes an extreme view of MyDoom.B that nobody else is
> supporting, including the sources they cite. MyDoom.B is a flop.

OK. So let's see. We've got one highly successful virus (MyDoom.A) on the
loose at the time of writing, another variant that's essentially identical
except for the target, and no clear indication why this one *shouldn't*
take off as well.

Yes, it took an extreme view that nobody is supporting *NOW*. Now isn't
last Wednesday night, when there wasn't a week's worth of hindsight.

Yes, it fizzled. Please point us at the information available to the CERT
guys *at the time* that proves there was *no* way that MyDoom.B could
possibly ever be a real threat. What would you have the CERT guys do,
*not* send the advisory just because they aren't 100% sure at the time?

I suppose you also understand why MyDoom-A was huge and Dumaru-whatever that
showed up 2 days before was a yawner. Also, note that I got more copies of
Dumary in the first 2 hours of THAT one than I got *total* of MyDoom-A - so
based on the first 2 hours from where *I* am, Dumaru was looking like a much
bigger event.

> Am I misreading something? Did anyone else get this on 1/28?

Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20]) by outgoing2.securityfocus.com (Postfix) with QMQP id B5ECF8F5D0; Mon, 02 Feb 2004 12:27:56 -0700 (MST)
Received: (qmail 11614 invoked from network); Thu, 29 Jan 2004 00:11:38 +0000
Date: Wed, 28 Jan 2004 19:12:09 -0500

Looks like some delay there. But it was already at SecurityFocus's qmail
within seconds (the Date: is actually 31 seconds ahead of the Received: once
you allow for timezones - somebody isn't using NTP ;)

--==_Exmh_1332279563P
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFAIQIzcC3lWbTT17ARAomlAJwPGC6OqK56sy2sVMAQ72 qb2AnfzACg7ziy
qdjyEJW7ywuNuAV99iB8VWw=
=ZAYc
-----END PGP SIGNATURE-----

--==_Exmh_1332279563P--

[Larry Seltzer]

>>OK. So let's see. We've got one highly successful virus (MyDoom.A) on =
the loose at
the time of writing, another variant that's essentially identical except =
for the target,
and no clear indication why this one *shouldn't* take off as well.
>>...
>>Yes, it took an extreme view that nobody is supporting *NOW*. Now =
isn't last
Wednesday night, when there wasn't a week's worth of hindsight.

The advisory specifically says that MyDoom.B is spreading rapidly, and =
that was never
the case. It didn't say that it *could* spread rapidly. Maybe you think =
misinforming in
order to induce caution is a good idea, but I expect nothing but the =
truth from an
agency like this.

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
larryseltzer@ziffdavis.com=20

[Eggers, Bill A [LTD]]

Seeing as how SCO got shut down and Washington Mutual (I tried to get =
money from them today and couldn't, they indicated the MyDoom.B was the =
cause of their problems and several other banks), I'd say it was more =
than just a minor bother and a little less than hysterical. However, =
they do have some strong language in their alert. I'm just glad the =
government is putting some real resources behind the effort.=20

Bill Eggers
Tech Support Manager
SprintDSL

-----Original Message-----
From: Larry Seltzer [mailto:larry@larryseltzer.com]
Sent: Tuesday, February 03, 2004 7:12 AM
To: bugtraq@securityfocus.com
Subject: Hysterical first technical alert from US-CERT


I just got the alert below from US-CERT. It's one of the new lists they =
started. Some
things about it bother me.

First, it's dated 1/28, the day MyDoom.B was discovered, and the message =
sent field says
that too; other dates in the headers disagree.=20

Second, and more to the point, it takes an extreme view of MyDoom.B that =
nobody else is
supporting, including the sources they cite. MyDoom.B is a flop.

Am I misreading something? Did anyone else get this on 1/28?

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
larryseltzer@ziffdavis.com=20

-----Original Message-----
From: CERT Advisory [mailto:cert-advisory@cert.org]=20
Sent: Wednesday, January 28, 2004 7:12 PM
To: US-CERT Community:
Subject: US CERT Technical Alert TA04-028A MyDoom.B Rapidly Spreading




-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


MyDoom.B Rapidly Spreading

Mydoom.B is a new variant of the Mydoom worm and is about 29,184
bytes. This variant attempts to perform a Distributed Denial of
Service (DDoS) attack against Microsoft.com. Details regarding this
new worm are still emerging, but it has been validated as spreading =
in
the wild. Facts about the worm will be further qualified with follow
up reports following this initial analysis.

For the latest information about this worm from US-CERT, readers are
encouraged to visit =
http://www.us-cert.gov/cas/techalerts/TA04-028A.html.

E-mails sent out by Mydoom.B are highly randomized. The From address
may be spoofed to include one of the following domains: aol.com,
msn.com, yahoo.com and hotmail.com. A randomized string value may =
then
be combined with these to generate new e-mails. This may result in
overload e-mail servers with many false addresses and auto-replies
associated with such traffic.

The subject is randomized to include one of the following
following:

* Delivery Error
* hello
* Error
* Mail Delivery System
* Mail Transaction Failed
* Returned mail
* Server Report
* Status
* Unable to deliver the message

The subject may also contain randomized data as seen in a recent live
sample: "RE: I still love you fLctv".

The message body is also randomized to include one of the
following:

* RANDOMIZED CHARACTERS
* test
* The message cannot be represented in 7-bit ASCII encoding and has
been sent as a binary attachment.
* sendmail daemon reported: Error #804 occured during SMTP session.
Partial message has been received.
* The message contains Unicode characters and has been sent as a
binary attachment.
* The message contains MIME-encoded graphics and has been sent as a
binary attachment.
* Mail transaction failed. Partial message is available.

The attachments have a randomized filename selected from one of the
following string values:

* body
* doc
* text
* document
* data
* file
* readme
* message

The randomized string value is then combined with a randomized
extension: .exe, .bat, .scr, .cmd or .pif. If the malicious =
attachment
is executed, it then opens notepad.exe and displays garbled data
(binary).

Once executed, the worm attempts to create the following files in the
Windows System directory: explorer.exe and dtfmon.dll. The Windows
registry is then modified to run the worm in memory upon Windows
startup:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Explorer=3DC:WINDOWS SYSTEM DIRECTORY\explorer.exe

The DLL component is associated with a backdoor feature of this worm.
It is likely that this Trojan worms like the one in Mydoom.A. It =
scans
through a range of TCP addresses looking for inbound TCP traffic.
Inbound TCP traffic can be used to configure the infected computer as
a proxy computer or to install code of choice on the infected
computer. More importantly, attackers are already working on tools to
hijack Mydoom infected computers to install code of choice.

The DDoS attack of Mydoom.B is against www.microsoft.com. There is
information claiming that it may also be directed at sco.com, but =
this
is unsubstantiated at this time. It appears that the more credible
data is that it only performs a DDoS attack against =
www.microsoft.com,
though a previosu version of the virus is confirmed to attack SCO.

To spread over the KaZaA P2P network, Mydoom.B creates copies of
itself in the KaZaA shared directory with randomized filenames.
Filenames include:

* attackXP-1.26
* BlackIce_Firewall_Enterpriseactivation_crack
* MS04-01_hotfix
* NessusScan_pro
* icq2004-final
* winamp5
* xsharez_scanner
* zapSetup_40_148

A randomized extension is then added to the filename selected above,
being .exe, .scr, .pif or .bat.

Mydoom.B attempts to harvest e-mails from Temporary Internet files as
well as via randomized e-mails aforementioned. It does not include =
any
e-mails containing the following strings: abuse, accoun, certific,
listserv, ntivi, icrosoft, admin, page, the.bat, gold-certs, feste,
submit, help, service, privacy, somebody, soft, contact, site, =
rating,
bugs, your, someone, anyone, nothing, nobody, noone, webmaster,
postmaster, support, samples, info, root, ruslis, nodomai, mydomai,
example, inpris, borlan, nai., sopho, foo., .mil, gov., .gov, panda,
icrosof, syma, kasper, mozilla, utgers.ed, tanford.e, acketst, secur,
isc.o, isi.e, ripe., arin., sendmail, rfc-ed, ietf, iana, usenet,
fido, linux, kernel, google, ibm.com, fsf., mit.e, math, unix,
berkeley and spam.

Mydoom.B also opens TCP port 10080. The worm contains the following
string: "sync-1.01; andy; I'm just doing my job, nothing personal,
sorry".

Alias: Mydoom, Novarg, Mydoom.B

Sources:

F-Secure Corp. (http://www.f-secure.com/v-descs/mydoom_b.shtml),
Jan. 28, 2004

Bit Defender
=
(http://www.bitdefender.com/bd/site/virusinfo.php?menu_id=3D1&v_id=3D186)=
,=20
Jan. 28, 2004

iDEFENSE Intelligence Operations, Jan. 28, 2004 Sensible Security
Solutions Inc. (http://www.sss.ca/), Jan. 28, 2004

According to iDEFENSE, this new variant of Mydoom appears to have
different MIMI data for malicious e-mails. The content type appears =
to
be plain text and includes a ZIP extension. Mydoom.A had a content
type of application/octet-stream and multipart/mixed data. It is
likely that this newest variant of Mydoom will become very widespread
in the wild. The first variant had well over 3M interceptions by just
two sources in the first 18 hours of the outbreak.

Look for questionable files about 29,184 bytes. Look for notepad.exe
to be opened, displaying binary data (garbled text). Also look for =
the
Windows registry created by the worm.

Recovery: Remove all files and the Windows registry key modifications
associated with this malicious code threat. Restore corrupted or
damaged files with clean backup copies.

Workaround: Configure e-mail servers and workstations to block file
types commonly used by malicious code to spread to other computers.
Block ZIP and executable extensions on the gateway and groupware
level. Also monitor traffic on the network and block ports associated
with Mydoom, especially inbound TCP ports for the backdoor Trojan
component and the outbound TCP 10080 port data. Administrators may
also find value in monitoring traffic associated with the DDoS
component. Carefully manage all new files, scanning them with updated
anti-virus software using heuristics prior to use.

Vendor Fix: Anti-virus vendors will likely release updated signature
files to protect against this malicious code in the near future. Some
anti-virus applications may detect this malicious code heuristically.

Name of Malicious Code: Mydoom.B
Aliases:
Mydoom.B
Mydoom
Novarg
Size in Bytes: 29184
Subjects: RE: I still love you fLctv
Body: Error 551: We are sorry your UTF-8 encoding is not supported
by the server, so the text was automatically zipped and attached to
this message.
Attachments: message.zip

This document was developed based on material contributed by =
iDEFENSE.
Our thanks for their contribution.

Last updated January 28, 2004
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFAGEufXlvNRxAkFWARAjEOAJ92cfCtcUVX+/6CGoRwGj7mIbxhzQCg0mdJ
/ip1ThurA7opfYb0JUET2UI=3D
=3Dj+iB
-----END PGP SIGNATURE-----

[Philip Rowlands]

On Tue, 3 Feb 2004, Larry Seltzer wrote:

>I just got the alert below from US-CERT. It's one of the new lists they
>started. Some things about it bother me.
>
>First, it's dated 1/28, the day MyDoom.B was discovered, and the
>message sent field says that too; other dates in the headers disagree.
>
>Second, and more to the point, it takes an extreme view of MyDoom.B
>that nobody else is supporting, including the sources they cite.
>MyDoom.B is a flop.
>
>Am I misreading something? Did anyone else get this on 1/28?

Yes; everyone subscribed to the [Carnegie Mellon] CERT/CC list. It's
been swallowed by US-CERT:

http://www.cert.org/advisories/us-cert-announcement.html

however...

"significant changes to CERT Advisories that will not only maintain the
accuracy and fairness that are the hallmarks of CERT Advisories, but
will also provide more information about more topics than before"

and

"We will maintain the same high quality control standards, edit content
for security and privacy, and work to ensure technical accuracy as well
as timeliness."

Thank DoHS for that!

[Andreas Marx]

Hi!

>I just got the alert below from US-CERT. It's one of the new lists they
>started. Some things about it bother me. First, it's dated 1/28, the day
>MyDoom.B was discovered, and the message sent field says that too; other
>dates in the headers disagree.

Yes, I got this report as well and I agree with you that MyDoom.B was not
able to spread widely at all. It looks like a mistake to me -- maybe they
wanted to warn for MyDoom.A instead of MyDoomB.?

At the time of the writing, Trend Micro's online scanner HouseCall has
found and cleaned more than 900.000 MyDoom.A-infected machines:
<http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MYDOOM.A&VSect=S>

However, they only found 7 (seven) MyDoom.B infected PCs world-wide:
<http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MYDOOM.B&VSect=S>

At least one av company has send out a wrong alert for MyDoom.B as well
(they wanted to update their MyDoom.A advisory, but they mixed-up both
worms descriptions).

A German news about this possible false alert can be found here:
http://www.heise.de/newsticker/meldung/44281

cheers,
Andreas

--
BSc. Andreas Marx <amarx@gega-it.de>, http://www.av-test.org
AV-Test GmbH, Klewitzstr. 7, 39112 Magdeburg, Germany
Phone: +49 (0)391 6075466, Fax: +49 (0)391 6075469

[Andrew Fried]

I'm a little surprised by some of the critical reactions to the
US-Cert's issuance of the MyDoom alerts.

Being in the federal sector, I can tell you that the predecessor to
US-CERT (FedCIRC) received ongoing criticism from the government
computer security circles for untimely advisories. FedCIRC was overly
cautious about validating information before disseminating it. The
result was that advisories were released so long after the event that
they proved to be of little benefit to those of us on the front lines
trying to mitigate problems. The joke used to be that we'd read about a
problem on Bugtra or NANOG, then a week later see the same information
from FedCIRC.

When DHS formed US-CERT, they held meetings around the country with a
variety of groups, not just federal security types, and the most
resounding request they got was to release alerts and advisories as soon
as possible. Many suggested that late breaking advisories be labeled as
preliminary, but released just the same. To US-CERT's credit, they
listened to those requests and what we saw with MyDoom was advisories
being released within hours of the onset of an incident.

Behind the scenes, US-CERT has established a number of secure channels
to facilitate information sharing among federal agencies. They've
established working groups which include private sector membership.
They're ramping up some new initiatives that will bring much needed
resources to the government such as labs to analyze malware. In my
mind, this group is trying to focus on cybersecurity needs with the same
intensity that NASA did to get to the moon.

I'm not trying to make any sales pitch here, and want to state that I do
not work with for DHS or US-CERT (which is part of DHS).

Andrew Fried
Senior Special Agent
Treasury Inspector General for Tax Administration

[Stephen Samuel]

Valdis.Kletnieks@vt.edu wrote:
> On Tue, 03 Feb 2004 07:11:49 EST, Larry Seltzer <larry@larryseltzer.com> said:
>>Second, and more to the point, it takes an extreme view of MyDoom.B that nobody else is
>>supporting, including the sources they cite. MyDoom.B is a flop.
>
> OK. So let's see. We've got one highly successful virus (MyDoom.A) on the
> loose at the time of writing, another variant that's essentially identical
> except for the target, and no clear indication why this one *shouldn't*
> take off as well.

Most of the time, I'd expect that a copycat virus is going to be
much smaller than the original, since that trick-space is now
going to be saturated.If there's nothing different in the
distribution of the virus, then I'd say they were silly to
presume it was going to be anywhere near as big as MyDoom A.
--
Stephen Samuel +1(604)876-0426 samuel@bcgreen.com
http://www.bcgreen.com/~samuel/
Powerful committed communication. Transformation touching
the jewel within each person and bringing it to light.

[Mary Landesman]

They're saying MyDoom.B **BECAUSE** of the bogus CERT reporting. Do you
really think your bank tellers know what the difference is? They don't. So
they take it at face value. Our local media keeps referring to MyDoom.B as
well. Because they got the same "Alert" everyone else in the media got -
saying MyDoom.B was rapidly spreading.

CERT did a disfavor to the media, the security company, and the industry
when they let that shoddy reporting go out on the wire.

-- Mary


----- Original Message -----
From: "Eggers, Bill A [LTD]" <William.A.Eggers@mail.sprint.com>
To: <bugtraq@securityfocus.com>
Sent: Tuesday, February 03, 2004 4:00 PM
Subject: RE: Hysterical first technical alert from US-CERT


Seeing as how SCO got shut down and Washington Mutual (I tried to get money
from them today and couldn't, they indicated the MyDoom.B was the cause of
their problems and several other banks), I'd say it was more than just a
minor bother and a little less than hysterical. However, they do have some
strong language in their alert. I'm just glad the government is putting some
real resources behind the effort.

Bill Eggers
Tech Support Manager
SprintDSL

-----Original Message-----
From: Larry Seltzer [mailto:larry@larryseltzer.com]
Sent: Tuesday, February 03, 2004 7:12 AM
To: bugtraq@securityfocus.com
Subject: Hysterical first technical alert from US-CERT


I just got the alert below from US-CERT. It's one of the new lists they
started. Some
things about it bother me.

First, it's dated 1/28, the day MyDoom.B was discovered, and the message
sent field says
that too; other dates in the headers disagree.

Second, and more to the point, it takes an extreme view of MyDoom.B that
nobody else is
supporting, including the sources they cite. MyDoom.B is a flop.

Am I misreading something? Did anyone else get this on 1/28?

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
larryseltzer@ziffdavis.com

-----Original Message-----
From: CERT Advisory [mailto:cert-advisory@cert.org]
Sent: Wednesday, January 28, 2004 7:12 PM
To: US-CERT Community:
Subject: US CERT Technical Alert TA04-028A MyDoom.B Rapidly Spreading




-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


MyDoom.B Rapidly Spreading

Mydoom.B is a new variant of the Mydoom worm and is about 29,184
bytes. This variant attempts to perform a Distributed Denial of
Service (DDoS) attack against Microsoft.com. Details regarding this
new worm are still emerging, but it has been validated as spreading in
the wild. Facts about the worm will be further qualified with follow
up reports following this initial analysis.

For the latest information about this worm from US-CERT, readers are
encouraged to visit http://www.us-cert.gov/cas/techalerts/TA04-028A.html.

E-mails sent out by Mydoom.B are highly randomized. The From address
may be spoofed to include one of the following domains: aol.com,
msn.com, yahoo.com and hotmail.com. A randomized string value may then
be combined with these to generate new e-mails. This may result in
overload e-mail servers with many false addresses and auto-replies
associated with such traffic.

The subject is randomized to include one of the following
following:

* Delivery Error
* hello
* Error
* Mail Delivery System
* Mail Transaction Failed
* Returned mail
* Server Report
* Status
* Unable to deliver the message

The subject may also contain randomized data as seen in a recent live
sample: "RE: I still love you fLctv".

The message body is also randomized to include one of the
following:

* RANDOMIZED CHARACTERS
* test
* The message cannot be represented in 7-bit ASCII encoding and has
been sent as a binary attachment.
* sendmail daemon reported: Error #804 occured during SMTP session.
Partial message has been received.
* The message contains Unicode characters and has been sent as a
binary attachment.
* The message contains MIME-encoded graphics and has been sent as a
binary attachment.
* Mail transaction failed. Partial message is available.

The attachments have a randomized filename selected from one of the
following string values:

* body
* doc
* text
* document
* data
* file
* readme
* message

The randomized string value is then combined with a randomized
extension: .exe, .bat, .scr, .cmd or .pif. If the malicious attachment
is executed, it then opens notepad.exe and displays garbled data
(binary).

Once executed, the worm attempts to create the following files in the
Windows System directory: explorer.exe and dtfmon.dll. The Windows
registry is then modified to run the worm in memory upon Windows
startup:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Explorer=C:WINDOWS SYSTEM DIRECTORY\explorer.exe

The DLL component is associated with a backdoor feature of this worm.
It is likely that this Trojan worms like the one in Mydoom.A. It scans
through a range of TCP addresses looking for inbound TCP traffic.
Inbound TCP traffic can be used to configure the infected computer as
a proxy computer or to install code of choice on the infected
computer. More importantly, attackers are already working on tools to
hijack Mydoom infected computers to install code of choice.

The DDoS attack of Mydoom.B is against www.microsoft.com. There is
information claiming that it may also be directed at sco.com, but this
is unsubstantiated at this time. It appears that the more credible
data is that it only performs a DDoS attack against www.microsoft.com,
though a previosu version of the virus is confirmed to attack SCO.

To spread over the KaZaA P2P network, Mydoom.B creates copies of
itself in the KaZaA shared directory with randomized filenames.
Filenames include:

* attackXP-1.26
* BlackIce_Firewall_Enterpriseactivation_crack
* MS04-01_hotfix
* NessusScan_pro
* icq2004-final
* winamp5
* xsharez_scanner
* zapSetup_40_148

A randomized extension is then added to the filename selected above,
being .exe, .scr, .pif or .bat.

Mydoom.B attempts to harvest e-mails from Temporary Internet files as
well as via randomized e-mails aforementioned. It does not include any
e-mails containing the following strings: abuse, accoun, certific,
listserv, ntivi, icrosoft, admin, page, the.bat, gold-certs, feste,
submit, help, service, privacy, somebody, soft, contact, site, rating,
bugs, your, someone, anyone, nothing, nobody, noone, webmaster,
postmaster, support, samples, info, root, ruslis, nodomai, mydomai,
example, inpris, borlan, nai., sopho, foo., .mil, gov., .gov, panda,
icrosof, syma, kasper, mozilla, utgers.ed, tanford.e, acketst, secur,
isc.o, isi.e, ripe., arin., sendmail, rfc-ed, ietf, iana, usenet,
fido, linux, kernel, google, ibm.com, fsf., mit.e, math, unix,
berkeley and spam.

Mydoom.B also opens TCP port 10080. The worm contains the following
string: "sync-1.01; andy; I'm just doing my job, nothing personal,
sorry".

Alias: Mydoom, Novarg, Mydoom.B

Sources:

F-Secure Corp. (http://www.f-secure.com/v-descs/mydoom_b.shtml),
Jan. 28, 2004

Bit Defender
(http://www.bitdefender.com/bd/site/virusinfo.php?menu_id=1&v_id=186),
Jan. 28, 2004

iDEFENSE Intelligence Operations, Jan. 28, 2004 Sensible Security
Solutions Inc. (http://www.sss.ca/), Jan. 28, 2004

According to iDEFENSE, this new variant of Mydoom appears to have
different MIMI data for malicious e-mails. The content type appears to
be plain text and includes a ZIP extension. Mydoom.A had a content
type of application/octet-stream and multipart/mixed data. It is
likely that this newest variant of Mydoom will become very widespread
in the wild. The first variant had well over 3M interceptions by just
two sources in the first 18 hours of the outbreak.

Look for questionable files about 29,184 bytes. Look for notepad.exe
to be opened, displaying binary data (garbled text). Also look for the
Windows registry created by the worm.

Recovery: Remove all files and the Windows registry key modifications
associated with this malicious code threat. Restore corrupted or
damaged files with clean backup copies.

Workaround: Configure e-mail servers and workstations to block file
types commonly used by malicious code to spread to other computers.
Block ZIP and executable extensions on the gateway and groupware
level. Also monitor traffic on the network and block ports associated
with Mydoom, especially inbound TCP ports for the backdoor Trojan
component and the outbound TCP 10080 port data. Administrators may
also find value in monitoring traffic associated with the DDoS
component. Carefully manage all new files, scanning them with updated
anti-virus software using heuristics prior to use.

Vendor Fix: Anti-virus vendors will likely release updated signature
files to protect against this malicious code in the near future. Some
anti-virus applications may detect this malicious code heuristically.

Name of Malicious Code: Mydoom.B
Aliases:
Mydoom.B
Mydoom
Novarg
Size in Bytes: 29184
Subjects: RE: I still love you fLctv
Body: Error 551: We are sorry your UTF-8 encoding is not supported
by the server, so the text was automatically zipped and attached to
this message.
Attachments: message.zip

This document was developed based on material contributed by iDEFENSE.
Our thanks for their contribution.

Last updated January 28, 2004
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFAGEufXlvNRxAkFWARAjEOAJ92cfCtcUVX+/6CGoRwGj7mIbxhzQCg0mdJ
/ip1ThurA7opfYb0JUET2UI=
=j+iB
-----END PGP SIGNATURE-----

[Darragh Bailey]

Quoting "Eggers, Bill A [LTD]" <William.A.Eggers@mail.sprint.com>:

> Seeing as how SCO got shut down and Washington Mutual (I tried to get money
> from them today and couldn't, they indicated the MyDoom.B was the cause of
> their problems and several other banks), I'd say it was more than just a
> minor bother and a little less than hysterical. However, they do have some
> strong language in their alert. I'm just glad the government is putting some
> real resources behind the effort.
>
> Bill Eggers
> Tech Support Manager
> SprintDSL
>

Just 1 minor quibble.

http://www.sco.com website didn't actually get taken down with the DoS. SCO
removed the A records so that there is no dns record to use to target the
website. So nice to see the worm foiled so easily. btw http://sco.com still
works and points to their website, and all of there sub systems seem to be
still up, so they effectively rendered the DoS null and void. All the mail
traffic still being generated is a pain though.

--
Darragh

"Nothing's foolproof to a sufficently talented fool"

[Valdis.Kletnieks@vt.edu]

--==_Exmh_-1723342094P
Content-Type: text/plain; charset=us-ascii

On Thu, 05 Feb 2004 00:33:47 PST, Stephen Samuel said:

> Most of the time, I'd expect that a copycat virus is going to be
> much smaller than the original, since that trick-space is now
> going to be saturated.If there's nothing different in the
> distribution of the virus, then I'd say they were silly to
> presume it was going to be anywhere near as big as MyDoom A.

In general, yes. However, in this case it was a copycat that
got loose *before* the general population got the meme for "this is
bad, don't click on it". And remember - they need to get a new
meme for each specific instance, as the average user can't seem to
generalize this. (Hmm.. didn't Stephenson's "Snow Crash" talk about
that? ;)



--==_Exmh_-1723342094P
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFAJBAKcC3lWbTT17ARAlRWAKCozW6egmO28FSBz4DNnr dwvYHvjwCgpPq6
cEmc+mhyi9J3W1djYfJsSHg=
=imkW
-----END PGP SIGNATURE-----

--==_Exmh_-1723342094P--

[Shawn McMahon]

--Qxx1br4bt0+wmkIi
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Fri, Feb 06, 2004 at 05:07:06PM -0500, Valdis.Kletnieks@vt.edu said:
>=20
> In general, yes. However, in this case it was a copycat that
> got loose *before* the general population got the meme for "this is
> bad, don't click on it". And remember - they need to get a new

One thing nobody seems to want to recognize as a possibility here is
that MyDoom.B didn't take off as much as MyDoom.A precisely BECAUSE of
the US-CERT email. A lot of members of the press took that pretty
seriously, and warnings on the evening network news shows that you
shouldn't open these attachments are bound to have prevented at least
some infections.


--=20
Shawn McMahon | Let every nation know, whether it wishes us well or ill,
EIV Consulting | that we shall pay any price, bear any burden, meet any
UNIX and Linux | hardship, support any friend, oppose any foe, to assure
http://www.eiv.com| the survival and the success of liberty. - JFK

--Qxx1br4bt0+wmkIi
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (GNU/Linux)

iD8DBQFAJjMkEcl9bQ0RMt0RAtb4AKCKtwKarsjlkTYP/aTdY30FQixP+gCfTDLO
TgCS5ftAdOm0iWJkYyba4co=
=d+dI
-----END PGP SIGNATURE-----

--Qxx1br4bt0+wmkIi--

[Stephen Martin]

> One thing nobody seems to want to recognize as a possibility here is
> that MyDoom.B didn't take off as much as MyDoom.A precisely BECAUSE of
> the US-CERT email. A lot of members of the press took that pretty
> seriously, and warnings on the evening network news shows that you
> shouldn't open these attachments are bound to have prevented at least
> some infections.

I would describe the MyDoom virus as hitting the main stream media several
days prior [01.27.03] to CERT's email. Most people [non-tech] that I talked
to, after 01.27ish had already heard of it and were extremely wary of
opening
anything.

Albeit their e-mail was a catapult to further media coverage, their report
was misrepresentative of the malware...which should be the bottom line.

Regards,
Stephen L. Martin