Re: Outbreak warning: possibly Mydoom.C (Now Deadhat/Vesser)

[Gadi Evron]

K-OTiK Security wrote:
> it's not mydoom.c - his name is Vesser (W32.HLLW.Deadhat) :

This is not Vesser. This is a new outbreak.

I doubt it will be huge, for obvious reasons, but it spreads.

Check out http://www.lurhq.com/mydoom-c.html

Gadi Evron.

[Nick FitzGerald]

K-OTiK Security <Special-Alerts@k-otik.com> wrote:

> it's not mydoom.c - ...

Correct.

> ... his name is Vesser (W32.HLLW.Deadhat) :

Not.

Vesser (which a few AV companies have called Deadhat) was discovered
early in the weekend spreading via Mydoom.A-infected machiens (and
rpesumably it would also hit the occasional Mydoom,.B out there too).
What Gadi alerted on as Mydoom.C has been agreed following analysis by
AV industry experts to be sufficiently different in critical ways from
Mydoom to be put in a new family and will be called Doomjuice.A by most
AVs.

> Vesser mainly targets computers that have previously been infected
> with the Mydoom.A or Mydoom.B worms. Vesser scans for the backdoors in
> those worms on IP addresses. While doing that it connects to TCP ports
> 1080. 3127 and 3128 and tries to copy itself there in a
> specially-crafted package.
>
> http://www.f-secure.com/v-descs/vesser.shtml
> http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.deadhat.html

Correct, but irrelevant to this thread...


--
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854

[K-OTiK Security]

In-Reply-To: <4027B328.4050305@egotistical.reprehensible.net>

it's not mydoom.c - his name is Vesser (W32.HLLW.Deadhat) :

Vesser mainly targets computers that have previously been infected with the Mydoom.A or Mydoom.B worms. Vesser scans for the backdoors in those worms on IP addresses. While doing that it connects to TCP ports 1080. 3127 and 3128 and tries to copy itself t
here in a specially-crafted package.

http://www.f-secure.com/v-descs/vesser.shtml
http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.deadhat.html

Regards.
C. Bekrar - Security Consultant
K-OTik Security (France)
http://www.k-otik.com


>Date: Mon, 09 Feb 2004 18:19:52 +0200
>From: Gadi Evron <ge@egotistical.reprehensible.net>
>To: bugtraq@securityfocus.com
>Subject: Outbreak warning: possibly Mydoom.C
>
>Uses the Mydoom backdoor to upload itself (over Mydoom ports).
>
>Seeded over the weekend, it is out now and spreads fast.
>
>Blocking: block Mydoom ports.
>
> Gadi Evron.
>
>

[Larry Seltzer]

All the AV companies are calling this new outbreak "Doomjuice"

Symantec: http://www.sarc.com/avcenter/venc/data/w32.hllw.doomjuice.html
McAfee: http://vil.nai.com/vil/content/v_101002.htm
Sophos: http://www.sophos.com/virusinfo/analyses/w32doomjuicea.html
Trend: http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_DOOMJUICE.A
Etc.

They all have it as a low-incidence in the wild. What I don't understand is that if it
hasn't spread, what caused the attack against Microsoft this morning?

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
larryseltzer@ziffdavis.com

[Gadi Evron]

> They all have it as a low-incidence in the wild. What I don't understand is that if it
> hasn't spread, what caused the attack against Microsoft this morning?

A worm that spreads this way can't become huge for obvious reasons, but
it still spreads, thus the DDoS against MS.

There is a some (naming) confusion in the different vendor web pages
about this worm, but the interesting part is that Mydoom.A's source code
is included.

Gadi

[Mary Landesman]

Actually, it's not Vesser either. Gadi is referring to Doomjuice, a.k.a.
MyDoom.C.

See:
http://www.lurhq.com/mydoom-c.html
http://antivirus.about.com/cs/allabout/a/doomjuice.htm
http://www.f-secure.com/v-descs/doomjuice.shtml

and for its impact on Microsoft, see:

http://www.f-secure.com/weblog/

-- Mary

----- Original Message -----
From: "K-OTiK Security" <Special-Alerts@k-otik.com>
To: <bugtraq@securityfocus.com>
Sent: Monday, February 09, 2004 1:01 PM
Subject: Re: Outbreak warning: possibly Mydoom.C (Now Deadhat/Vesser)


In-Reply-To: <4027B328.4050305@egotistical.reprehensible.net>

it's not mydoom.c - his name is Vesser (W32.HLLW.Deadhat) :

Vesser mainly targets computers that have previously been infected with the
Mydoom.A or Mydoom.B worms. Vesser scans for the backdoors in those worms on
IP addresses. While doing that it connects to TCP ports 1080. 3127 and 3128
and tries to copy itself there in a specially-crafted package.

http://www.f-secure.com/v-descs/vesser.shtml
http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.deadhat.html

Regards.
C. Bekrar - Security Consultant
K-OTik Security (France)
http://www.k-otik.com


>Date: Mon, 09 Feb 2004 18:19:52 +0200
>From: Gadi Evron <ge@egotistical.reprehensible.net>
>To: bugtraq@securityfocus.com
>Subject: Outbreak warning: possibly Mydoom.C
>
>Uses the Mydoom backdoor to upload itself (over Mydoom ports).
>
>Seeded over the weekend, it is out now and spreads fast.
>
>Blocking: block Mydoom ports.
>
> Gadi Evron.
>
>

[Nick FitzGerald]

"Larry Seltzer" <larry@larryseltzer.com> wrote:

Sorry -- I missed this yesterday...

> All the AV companies are calling this new outbreak "Doomjuice"

Indeed, for reasons explained in my message yesterday...

> They all have it as a low-incidence in the wild. What I don't
> understand is that if it hasn't spread, what caused the attack against
> Microsoft this morning?

There are two aspects to this. First, as Gadi suggested, depending on
the nature of the DDoS attack, a "low incidence" DDoS attack agent can
still perform a very effective attack (this is particularly so if the
DoS part of the attack involves some significant multiplier effect --
very few bytes sent, massive CPU, network response, etc load
generated). I'm not entirely sure this is the case here, but haven't
looked closely at it with this in mind...

Second, how does AV (mostly) judge the incidence of viruses, worms and
so on? Right -- from incident and rate data collected from their
scanners, etc. Such measures, by their very nature, will be almost
blind to Doomjuice. Why? Because Doomjuice _only_ spreads via
Mydoom.A/.B infected machines and only across the net, P2P-like in
direct machine-to-machine manner. By and large, AV does not monitor
such things and to do so, it would actually have to run a Mydoom-
emulating listener. If AV did monitor for this kind of threat, what
would it cost? First, it would be soaking up the user's CPU cycles and
other resources for the "benefit" of monitoring this attack vector
which is the something the user is not actually vulnerable to because
they have up-to-date AV and thus, we can assume, are not infected with
Mydoom in the first place. Multiply by all the other similar backdoors
and what have you and the load AV s/w imposes on your typical PC (which
many users of some products already describe as "crippling" the
machine) would increase considerably. So, Doomjuice only spreads
through machines that do not have up-to-date AV (else they wouldn't
have Mydoom to let it in) and only spreads through a medium that AV
developers (in particular) do not monitor at all closely (notice that
Email-specific services/vendors such as MessageLabs and Postini will
not be reporting Doomjuice _at all_ -- I haven't checked, but if they
are it will be tiny numbers and due to an occasional user-initiated
action, such as attaching a suspect .EXE to an Email and sending it to
a security or AV vendor).

However, a few folk do have relatively specific monitoring for such
things. Given the rate I'm hearing of _proven_ Doomjuice distribution
attempts (i.e. the code sent through the "Mydoom update" mechanism is
actually captured and well-fingerprinted rather than assumed to be
Doomjuice from some very limited partial capture/signature such as some
IDS systems are using), it certainly is no Slammer, CodeRed or Blaster,
but it is definitely out there and probably in numbers enough to
trouble www.microsoft.com... (That said, www.microsoft.com did not
seem troubled from New Zealand for much of yesterday. It was dead slow
late last night but seems OK again this morning -- for now it is
resolving to www2.microsoft.akadns.net, IP:207.46.245.92.)


--
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854