New Worm??? - High level of activity on port 445

[Tony Abell]

Since late yesterday 4/28/04 afternoon around 4pm our firewall started
throwing alarms on netprobes. We are seeing a large amount of probes coming
from one machine that is probing random IPs on port 445. The source port is
random as well. We traced it back to a Japanese Win2K machine w/SP4
installed. No idea if it's fully patched or not, I have no desire to put it
back on my network to patch it until I get this figured out. I scanned the
machine in safe mode as well as booting normally using SAV 8.1 with 4/28/04
Rev 38 defs and came up with nothing.

Is anyone else seeing anything like this?

Tony Abell
Network Administrator
OSG Tap & Die

[Roger A. Grimes]

Without any more details, like traffic captures, I can only assume it is
one of the new Lsass worms looking for MS04-011 vulnerable machines. =20

http://www.sarc.com/avcenter/venc/data/hacktool.lsasssba.html

Roger

************************************************** **********************
***
*Roger A. Grimes, Computer Security Consultant=20
*CPA, CISSP, MCSE: Security (NT/2000/2003/MVP), CNE (3/4), A+
*email: roger@banneretcs.com
*cell: 757-615-3355
*Author of Malicious Mobile Code: Virus Protection for Windows by
O'Reilly
*http://www.oreilly.com/catalog/malmobcode
*Author of upcoming Honeypots for Windows (Apress)
************************************************** **********************
****



-----Original Message-----
From: Tony Abell [mailto:TonAbe@osgtool.com]=20
Sent: Thursday, April 29, 2004 12:45 PM
To: 'bugtraq@securityfocus.com'
Subject: New Worm??? - High level of activity on port 445

Since late yesterday 4/28/04 afternoon around 4pm our firewall started
throwing alarms on netprobes. We are seeing a large amount of probes
coming from one machine that is probing random IPs on port 445. The
source port is random as well. We traced it back to a Japanese Win2K
machine w/SP4 installed. No idea if it's fully patched or not, I have no
desire to put it back on my network to patch it until I get this figured
out. I scanned the machine in safe mode as well as booting normally
using SAV 8.1 with 4/28/04 Rev 38 defs and came up with nothing.

Is anyone else seeing anything like this?=20

Tony Abell
Network Administrator
OSG Tap & Die

[Jodrell Dimaculangan]

This maybe a clue,

There was a new variant of the AGOBOT worm that we "uncovered". =20
In Safe Mode run regedt32
goto\HKLM\software\Microsoft\Windows\CurrentVersio n\Run and RunServices
Look for any Symantec entries (it will look official but since we do not
use Symantec NAV, it brought up red flags). Delete.

In CLI, go to Winnt\System32
Search for a navpaw32.exe or a navpxaw32.exe
Remove all permission to prevent this file from being run

Restart PC. On your firewall check for port scanning. This worm will
attempt to propagate.

Hope this helps.

BTW...Trend Micro release a new pattern because of us.


Jodrell P. Dimaculangan=20
Manager - Technical Support Group
People's Choice=20
Home Loan, Inc.=20
Helpdesk: 949-341-2035=20
Phone: 949-341-2009=20
Fax: 949-341-5440=20
< <mailto:helpdesk@pchli.com>>=20
< <mailto:Jodrell@pchli.com>>=20

CONFIDENTIALITY AND DISCLAIMER NOTICE=20
This e-mail is intended only for the addressee named above and the
contents should not be disclosed to any other person nor copies taken.
As Internet communications are not secure we do not accept legal
responsibility for the contents of this message nor responsibility for
any change made to this message after the original sender sent it. We
advise you to carry out your own virus check before opening any
attachment, as we cannot accept liability for any damage sustained as a
result of any software viruses. If you have received this e-mail in
error, please notify us immediately by replying to this email or by
calling our technical support department 949-341-2035.


-----Original Message-----
From: Tony Abell [mailto:TonAbe@osgtool.com]=20
Sent: Thursday, April 29, 2004 9:45 AM
To: 'bugtraq@securityfocus.com'
Subject: New Worm??? - High level of activity on port 445

Since late yesterday 4/28/04 afternoon around 4pm our firewall started
throwing alarms on netprobes. We are seeing a large amount of probes
coming from one machine that is probing random IPs on port 445. The
source port is random as well. We traced it back to a Japanese Win2K
machine w/SP4 installed. No idea if it's fully patched or not, I have no
desire to put it back on my network to patch it until I get this figured
out. I scanned the machine in safe mode as well as booting normally
using SAV 8.1 with 4/28/04 Rev 38 defs and came up with nothing.

Is anyone else seeing anything like this?=20

Tony Abell
Network Administrator
OSG Tap & Die

[Thor Larholm]

MS04-011 fixed 14 different vulnerabilities but the two that have
received most attention are the PCT and LSASS vulnerabilities. Both have
publicly available exploit code and are fairly trivial to automate.

You are most likely experiencing traffic caused by the LSASS
vulnerability. To successfully exploit this vulnerability either locally
or remotely, one has to acquire the handle of a running user session.
Remote exploits and worms can only exploit the LSASS vulnerability
anonymously by using a NULL session, which is retrieved over the
microsoft-ds port 445.

It has long been a good practice to disable NULL sessions, and Microsoft
has documented how to accomplish this in several Knowledge Base
articles:

How to Use the RestrictAnonymous Registry Value in Windows 2000
http://support.microsoft.com/?kbid=3D246261
Restricting information available to anonymous logon users
http://support.microsoft.com/?kbid=3D143474
RestrictAnonymous Access Enabled Lets Anonymous Connections Obtain the
Password Policy
http://support.microsoft.com/?kbid=3D129457

The RestrictAnonymous policy can have some impact on functionality in
mixed-domain environments, in which case one can set the
RestrictAnonymous value to 1 instead of 2, as detailed in the following
Knowledge Base articles:

The "RestrictAnonymous" Registry Value May Break the Trust to a Windows
2000 Domain
http://support.microsoft.com/?kbid=3D296405
The RestrictAnonymous Value Breaks the Trust in a Mixed-Domain
Environment
http://support.microsoft.com/?kbid=3D296403


The PCT vulnerability is exploited over port 443 which have led many to
believe that it was intrinsically linked with SSL - it is not, it is a
separate protocol and can be separately disabled. (The PCT/SSL confusion
gave a dilemma as some production servers naturally rely on SSL but
could not implement the patch as it has several functionality
regressions).

When IIS receives a request for a secure communication channel over port
443 it tries several independent protocols in the following order: PCT
1.0, SSL 2.0, SSL 3.0 and TLS 1.0. Disabling the PCT protocol itself
does not impact SSL functionality and can be accomplished by specifying
a binary value of 00000000 in the following value:

HKey_Local_Machine\System\CurrentControlSet\Contro l\SecurityProviders\SC
HANNEL\Protocols\PCT 1.0\ServerEnabled

This has also been documented in Knowledge Base article 187498

Disable PCT 1.0, SSL 2.0, or SSL 3.0 on IIS
http://support.microsoft.com/?kbid=3D187498


Regards

Thor Larholm
Senior Security Researcher
PivX Solutions
24 Corporate Plaza #180
Newport Beach, CA 92660
http://www.pivx.com
thor@pivx.com
Stock symbol: (OTCBB:DRIL)
Phone: +1 (949) 231-8496
PGP: 0x5A276569
6BB1 B77F CB62 0D3D 5A82 C65D E1A4 157C 5A27 6569

PivX defines a new genre in Desktop Security: Proactive Threat
Mitigation.=20
<http://www.pivx.com/qwikfix>



-----Original Message-----
From: Tony Abell [mailto:TonAbe@osgtool.com]=20
Sent: Thursday, April 29, 2004 9:45 AM
To: 'bugtraq@securityfocus.com'
Subject: New Worm??? - High level of activity on port 445


Since late yesterday 4/28/04 afternoon around 4pm our firewall started
throwing alarms on netprobes. We are seeing a large amount of probes
coming from one machine that is probing random IPs on port 445. The
source port is random as well. We traced it back to a Japanese Win2K
machine w/SP4 installed. No idea if it's fully patched or not, I have no
desire to put it back on my network to patch it until I get this figured
out. I scanned the machine in safe mode as well as booting normally
using SAV 8.1 with 4/28/04 Rev 38 defs and came up with nothing.

Is anyone else seeing anything like this?=20

Tony Abell
Network Administrator
OSG Tap & Die