Onderwerp: RE: Hysterical first technical alert from US-CERT - CERT#25304

We=20got=20this=20alert=20too=20and=20it=20was=20d efinitely=20a=20mistake=20=
as=20MyDoom.B
never=20took=20off.=20We=20received=20it=2029=20Ja n=202004=2001:56:52=20GM=
T=20which
confirms=20CERTs=20mail=20server=20time=20stamp:=2 0Wed,=2028=20Jan=202004=20=
20:55:16=20-0500

Last=20time=20I=20had=20a=20look=20at=20our=20stat istics=20we=20had=20stop=
ped=20approx
21=20Million=20copies=20of=20MyDoom.A=20and=20...= 20200=20of=20MyDoom.B!

It=20would=20be=20interesting=20to=20know=20why=20 US-CERT=20made=20their=20=
original
judgement.=20However,=20I=20wouldn't=20judge=20the m=20too=20hard=20on=20th=
is=20one.
Security=20Incident=20Response=20Teams=20have=20to =20consider=20the=20time=
liness=20of=20
warnings=20which=20works=20against=20accuracy=20an d=20verification=20of=20=
sources.
Given=20the=20incredible=20spread=20of=20MyDoom.A= 20I=20can=20understand=20=
why=20this
happened.

I=20am=20not=20saying=20that=20SIRTs=20should=20be =20lax=20about=20validat=
ing=20their
information=20in=20most=20cases.=20But=20if=20they =20make=20a=20mistake=20=
like=20this
under=20urgent=20conditions=20on=20rare=20occasion s=20I=20will=20still=20b=
e=20happy
with=20their=20service.=20However,=20a=20warning=2 0like=20"we=20have=20not=
=20yet=20validated
this"=20or=20usage=20of=20wording=20like=20"it=20a ppears=20that"=20would=20=
have=20been
more=20appropriate.=20It=20would=20also=20have=20b een=20appropriate=20to=20=
issue
a=20correction=20later=20IMHO.

Best=20regards
Steen=20Larsen

_________________________________=20

Steen=20Larsen=20
Director=20of=20Security=20
MessageLabs=20Ltd.=20

E=20-=20slarsen@messagelabs.com=20
DD=20-=20+44=20(0)=201452=20627639=20
F=20-=20+44=20(0)=201452=20627628=20
W=20-=20www.messagelabs.com=20

Company=20Registration=20No=20-=20=203834506
________________________________=20




-----Original=20Message-----
From:=20Larry=20Seltzer=20[mailto:larry@larryseltzer.com]
Sent:=2003=20February=202004=2012:12
To:=20bugtraq@securityfocus.com
Subject:=20Hysterical=20first=20technical=20alert= 20from=20US-CERT


I=20just=20got=20the=20alert=20below=20from=20US-CERT.=20It's=20one=20of=20=
the=20new=20lists=20they=20started.=20Some
things=20about=20it=20bother=20me.

First,=20it's=20dated=201/28,=20the=20day=20MyDoom.B=20was=20discovered,=20=
and=20the=20message=20sent=20field=20says
that=20too;=20other=20dates=20in=20the=20headers=2 0disagree.=20

Second,=20and=20more=20to=20the=20point,=20it=20ta kes=20an=20extreme=20vie=
w=20of=20MyDoom.B=20that=20nobody=20else=20is
supporting,=20including=20the=20sources=20they=20c ite.=20MyDoom.B=20is=20a=
=20flop.

Am=20I=20misreading=20something?=20Did=20anyone=20 else=20get=20this=20on=20=
1/28?

Larry=20Seltzer
eWEEK.com=20Security=20Center=20Editor
http://security.eweek.com/
larryseltzer@ziffdavis.com=20

-----Original=20Message-----
From:=20CERT=20Advisory=20[mailto:cert-advisory@cert.org]=20
Sent:=20Wednesday,=20January=2028,=202004=207:12=2 0PM
To:=20US-CERT=20Community:
Subject:=20US=20CERT=20Technical=20Alert=20TA04-028A=20MyDoom.B=20Rapidly=20=
Spreading




-----BEGIN=20PGP=20SIGNED=20MESSAGE-----
Hash:=20SHA1


MyDoom.B=20Rapidly=20Spreading

=20=20=20Mydoom.B=20is=20a=20new=20variant=20of=20 the=20Mydoom=20worm=20an=
d=20is=20about=2029,184
=20=20=20bytes.=20This=20variant=20attempts=20to=2 0perform=20a=20Distribut=
ed=20Denial=20of
=20=20=20Service=20(DDoS)=20attack=20against=20Mic rosoft.com.=20Details=20=
regarding=20this
=20=20=20new=20worm=20are=20still=20emerging,=20bu t=20it=20has=20been=20va=
lidated=20as=20spreading=20in
=20=20=20the=20wild.=20Facts=20about=20the=20worm= 20will=20be=20further=20=
qualified=20with=20follow
=20=20=20up=20reports=20following=20this=20initial =20analysis.

=20=20=20For=20the=20latest=20information=20about= 20this=20worm=20from=20U=
S-CERT,=20readers=20are
=20=20=20encouraged=20to=20visit=20http://www.us-cert.gov/cas/techalerts/T=
A04-028A.html.

=20=20=20E-mails=20sent=20out=20by=20Mydoom.B=20are=20highly= 20randomized.=
=20The=20From=20address
=20=20=20may=20be=20spoofed=20to=20include=20one=2 0of=20the=20following=20=
domains:=20aol.com,
=20=20=20msn.com,=20yahoo.com=20and=20hotmail.com. =20A=20randomized=20stri=
ng=20value=20may=20then
=20=20=20be=20combined=20with=20these=20to=20gener ate=20new=20e-mails.=20T=
his=20may=20result=20in
=20=20=20overload=20e-mail=20servers=20with=20many=20false=20addresses=2 0a=
nd=20auto-replies
=20=20=20associated=20with=20such=20traffic.

=20=20=20The=20subject=20is=20randomized=20to=20in clude=20one=20of=20the=20=
following
=20=20=20following:

=20=20=20=20=20*=20Delivery=20Error
=20=20=20=20=20*=20hello
=20=20=20=20=20*=20Error
=20=20=20=20=20*=20Mail=20Delivery=20System
=20=20=20=20=20*=20Mail=20Transaction=20Failed
=20=20=20=20=20*=20Returned=20mail
=20=20=20=20=20*=20Server=20Report
=20=20=20=20=20*=20Status
=20=20=20=20=20*=20Unable=20to=20deliver=20the=20m essage

=20=20=20The=20subject=20may=20also=20contain=20ra ndomized=20data=20as=20s=
een=20in=20a=20recent=20live
=20=20=20sample:=20"RE:=20I=20still=20love=20you=2 0fLctv".

=20=20=20The=20message=20body=20is=20also=20random ized=20to=20include=20on=
e=20of=20the
=20=20=20following:

=20=20=20=20=20*=20RANDOMIZED=20CHARACTERS
=20=20=20=20=20*=20test
=20=20=20=20=20*=20The=20message=20cannot=20be=20r epresented=20in=207-bit=20=
ASCII=20encoding=20and=20has
=20=20=20=20=20=20=20been=20sent=20as=20a=20binary =20attachment.
=20=20=20=20=20*=20sendmail=20daemon=20reported:=2 0Error=20#804=20occured=20=
during=20SMTP=20session.
=20=20=20=20=20=20=20Partial=20message=20has=20bee n=20received.
=20=20=20=20=20*=20The=20message=20contains=20Unic ode=20characters=20and=20=
has=20been=20sent=20as=20a
=20=20=20=20=20=20=20binary=20attachment.
=20=20=20=20=20*=20The=20message=20contains=20MIME-encoded=20graphics=20an=
d=20has=20been=20sent=20as=20a
=20=20=20=20=20=20=20binary=20attachment.
=20=20=20=20=20*=20Mail=20transaction=20failed.=20 Partial=20message=20is=20=
available.

=20=20=20The=20attachments=20have=20a=20randomized =20filename=20selected=20=
from=20one=20of=20the
=20=20=20following=20string=20values:

=20=20=20=20=20*=20body
=20=20=20=20=20*=20doc
=20=20=20=20=20*=20text
=20=20=20=20=20*=20document
=20=20=20=20=20*=20data
=20=20=20=20=20*=20file
=20=20=20=20=20*=20readme
=20=20=20=20=20*=20message

=20=20=20The=20randomized=20string=20value=20is=20 then=20combined=20with=20=
a=20randomized
=20=20=20extension:=20.exe,=20.bat,=20.scr,=20.cmd =20or=20.pif.=20If=20the=
=20malicious=20attachment
=20=20=20is=20executed,=20it=20then=20opens=20note pad.exe=20and=20displays=
=20garbled=20data
=20=20=20(binary).

=20=20=20Once=20executed,=20the=20worm=20attempts= 20to=20create=20the=20fo=
llowing=20files=20in=20the
=20=20=20Windows=20System=20directory:=20explorer. exe=20and=20dtfmon.dll.=20=
The=20Windows
=20=20=20registry=20is=20then=20modified=20to=20ru n=20the=20worm=20in=20me=
mory=20upon=20Windows
=20=20=20startup:

=20=20=20=20=20HKLM\Software\Microsoft\Windows\Cur rentVersion\Run
=20=20=20=20=20Explorer=3DC:WINDOWS=20SYSTEM=20DIR ECTORY\explorer.exe

=20=20=20The=20DLL=20component=20is=20associated=2 0with=20a=20backdoor=20f=
eature=20of=20this=20worm.
=20=20=20It=20is=20likely=20that=20this=20Trojan=2 0worms=20like=20the=20on=
e=20in=20Mydoom.A.=20It=20scans
=20=20=20through=20a=20range=20of=20TCP=20addresse s=20looking=20for=20inbo=
und=20TCP=20traffic.
=20=20=20Inbound=20TCP=20traffic=20can=20be=20used =20to=20configure=20the=20=
infected=20computer=20as
=20=20=20a=20proxy=20computer=20or=20to=20install= 20code=20of=20choice=20o=
n=20the=20infected
=20=20=20computer.=20More=20importantly,=20attacke rs=20are=20already=20wor=
king=20on=20tools=20to
=20=20=20hijack=20Mydoom=20infected=20computers=20 to=20install=20code=20of=
=20choice.

=20=20=20The=20DDoS=20attack=20of=20Mydoom.B=20is= 20against=20www.microsof=
t.com.=20There=20is
=20=20=20information=20claiming=20that=20it=20may= 20also=20be=20directed=20=
at=20sco.com,=20but=20this
=20=20=20is=20unsubstantiated=20at=20this=20time.= 20It=20appears=20that=20=
the=20more=20credible
=20=20=20data=20is=20that=20it=20only=20performs=2 0a=20DDoS=20attack=20aga=
inst=20www.microsoft.com,
=20=20=20though=20a=20previosu=20version=20of=20th e=20virus=20is=20confirm=
ed=20to=20attack=20SCO.

=20=20=20To=20spread=20over=20the=20KaZaA=20P2P=20 network,=20Mydoom.B=20cr=
eates=20copies=20of
=20=20=20itself=20in=20the=20KaZaA=20shared=20dire ctory=20with=20randomize=
d=20filenames.
=20=20=20Filenames=20include:

=20=20=20=20=20*=20attackXP-1.26
=20=20=20=20=20*=20BlackIce_Firewall_Enterpriseact ivation_crack
=20=20=20=20=20*=20MS04-01_hotfix
=20=20=20=20=20*=20NessusScan_pro
=20=20=20=20=20*=20icq2004-final
=20=20=20=20=20*=20winamp5
=20=20=20=20=20*=20xsharez_scanner
=20=20=20=20=20*=20zapSetup_40_148

=20=20=20A=20randomized=20extension=20is=20then=20 added=20to=20the=20filen=
ame=20selected=20above,
=20=20=20being=20.exe,=20.scr,=20.pif=20or=20.bat.

=20=20=20Mydoom.B=20attempts=20to=20harvest=20e-mails=20from=20Temporary=20=
Internet=20files=20as
=20=20=20well=20as=20via=20randomized=20e-mails=20aforementioned.=20It=20d=
oes=20not=20include=20any
=20=20=20e-mails=20containing=20the=20following=20strings:=20 abuse,=20acco=
un,=20certific,
=20=20=20listserv,=20ntivi,=20icrosoft,=20admin,=2 0page,=20the.bat,=20gold=
-certs,=20feste,
=20=20=20submit,=20help,=20service,=20privacy,=20s omebody,=20soft,=20conta=
ct,=20site,=20rating,
=20=20=20bugs,=20your,=20someone,=20anyone,=20noth ing,=20nobody,=20noone,=20=
webmaster,
=20=20=20postmaster,=20support,=20samples,=20info, =20root,=20ruslis,=20nod=
omai,=20mydomai,
=20=20=20example,=20inpris,=20borlan,=20nai.,=20so pho,=20foo.,=20.mil,=20g=
ov.,=20.gov,=20panda,
=20=20=20icrosof,=20syma,=20kasper,=20mozilla,=20u tgers.ed,=20tanford.e,=20=
acketst,=20secur,
=20=20=20isc.o,=20isi.e,=20ripe.,=20arin.,=20sendm ail,=20rfc-ed,=20ietf,=20=
iana,=20usenet,
=20=20=20fido,=20linux,=20kernel,=20google,=20ibm. com,=20fsf.,=20mit.e,=20=
math,=20unix,
=20=20=20berkeley=20and=20spam.

=20=20=20Mydoom.B=20also=20opens=20TCP=20port=2010 080.=20The=20worm=20cont=
ains=20the=20following
=20=20=20string:=20"sync-1.01;=20andy;=20I'm=20just=20doing=20my=20job,=20=
nothing=20personal,
=20=20=20sorry".

=20=20=20Alias:=20Mydoom,=20Novarg,=20Mydoom.B

=20=20=20Sources:

=20=20=20=20=20F-Secure=20Corp.=20(http://www.f-secure.com/v-descs/mydoom_=
b.shtml),
=20=20=20=20=20Jan.=2028,=202004

=20=20=20=20=20Bit=20Defender
=20=20=20=20=20(http://www.bitdefender.com/bd/site/v...hp?menu_id=3D=
1&v_id=3D186),=20
=20=20=20=20=20Jan.=2028,=202004

=20=20=20=20=20iDEFENSE=20Intelligence=20Operation s,=20Jan.=2028,=202004=20=
Sensible=20Security
=20=20=20=20=20Solutions=20Inc.=20(http://www.sss.ca/),=20Jan.=2028,=20200=
4

=20=20=20According=20to=20iDEFENSE,=20this=20new=2 0variant=20of=20Mydoom=20=
appears=20to=20have
=20=20=20different=20MIMI=20data=20for=20malicious =20e-mails.=20The=20cont=
ent=20type=20appears=20to
=20=20=20be=20plain=20text=20and=20includes=20a=20 ZIP=20extension.=20Mydoo=
m.A=20had=20a=20content
=20=20=20type=20of=20application/octet-stream=20and=20multipart/mixed=20da=
ta.=20It=20is
=20=20=20likely=20that=20this=20newest=20variant=2 0of=20Mydoom=20will=20be=
come=20very=20widespread
=20=20=20in=20the=20wild.=20The=20first=20variant= 20had=20well=20over=203M=
=20interceptions=20by=20just
=20=20=20two=20sources=20in=20the=20first=2018=20h ours=20of=20the=20outbre=
ak.

=20=20=20Look=20for=20questionable=20files=20about =2029,184=20bytes.=20Loo=
k=20for=20notepad.exe
=20=20=20to=20be=20opened,=20displaying=20binary=2 0data=20(garbled=20text)=
..=20Also=20look=20for=20the
=20=20=20Windows=20registry=20created=20by=20the=2 0worm.

=20=20=20Recovery:=20Remove=20all=20files=20and=20 the=20Windows=20registry=
=20key=20modifications
=20=20=20associated=20with=20this=20malicious=20co de=20threat.=20Restore=20=
corrupted=20or
=20=20=20damaged=20files=20with=20clean=20backup=2 0copies.

=20=20=20Workaround:=20Configure=20e-mail=20servers=20and=20workstations=20=
to=20block=20file
=20=20=20types=20commonly=20used=20by=20malicious= 20code=20to=20spread=20t=
o=20other=20computers.
=20=20=20Block=20ZIP=20and=20executable=20extensio ns=20on=20the=20gateway=20=
and=20groupware
=20=20=20level.=20Also=20monitor=20traffic=20on=20 the=20network=20and=20bl=
ock=20ports=20associated
=20=20=20with=20Mydoom,=20especially=20inbound=20T CP=20ports=20for=20the=20=
backdoor=20Trojan
=20=20=20component=20and=20the=20outbound=20TCP=20 10080=20port=20data.=20A=
dministrators=20may
=20=20=20also=20find=20value=20in=20monitoring=20t raffic=20associated=20wi=
th=20the=20DDoS
=20=20=20component.=20Carefully=20manage=20all=20n ew=20files,=20scanning=20=
them=20with=20updated
=20=20=20anti-virus=20software=20using=20heuristics=20prior=20to =20use.

=20=20=20Vendor=20Fix:=20Anti-virus=20vendors=20will=20likely=20release=20=
updated=20signature
=20=20=20files=20to=20protect=20against=20this=20m alicious=20code=20in=20t=
he=20near=20future.=20Some
=20=20=20anti-virus=20applications=20may=20detect=20this=20malic ious=20cod=
e=20heuristically.

=20=20=20=20=20Name=20of=20Malicious=20Code:=20Myd oom.B
=20=20=20=20=20Aliases:
=20=20=20=20=20Mydoom.B
=20=20=20=20=20Mydoom
=20=20=20=20=20Novarg
=20=20=20=20=20Size=20in=20Bytes:=2029184
=20=20=20=20=20Subjects:=20RE:=20I=20still=20love= 20you=20fLctv
=20=20=20=20=20Body:=20Error=20551:=20We=20are=20s orry=20your=20UTF-8=20en=
coding=20is=20not=20supported
=20=20=20=20=20by=20the=20server,=20so=20the=20tex t=20was=20automatically=20=
zipped=20and=20attached=20to
=20=20=20=20=20this=20message.
=20=20=20=20=20Attachments:=20message.zip

=20=20=20This=20document=20was=20developed=20based =20on=20material=20contr=
ibuted=20by=20iDEFENSE.
=20=20=20Our=20thanks=20for=20their=20contribution .

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=2 0=20=20=20=20=20=20Last=20=
updated=20January=2028,=202004
-----BEGIN=20PGP=20SIGNATURE-----
Version:=20GnuPG=20v1.2.1=20(GNU/Linux)

iD8DBQFAGEufXlvNRxAkFWARAjEOAJ92cfCtcUVX+/6CGoRwGj7mIbxhzQCg0mdJ
/ip1ThurA7opfYb0JUET2UI=3D
=3Dj+iB
-----END=20PGP=20SIGNATURE-----



__________________________________________________ ______________________
This=20email=20has=20been=20scanned=20for=20all=20 viruses=20by=20the=20Mes=
sageLabs=20Email
Security=20System.=20For=20more=20information=20on =20a=20proactive=20email=
=20security
service=20working=20around=20the=20clock,=20around =20the=20globe,=20visit
http://www.messagelabs.com
__________________________________________________ ______________________

__________________________________________________ ______________________
This=20email=20has=20been=20scanned=20for=20all=20 viruses=20by=20the=20Mes=
sageLabs=20Email
Security=20System.=20For=20more=20information=20on =20a=20proactive=20email=
=20security
service=20working=20around=20the=20clock,=20around =20the=20globe,=20visit
http://www.messagelabs.com
__________________________________________________ ______________________