Det skal lige siges at selvom denne specifikke orm kun benytter port
135 TCP er der også andre porte der er potentielle angrebspunkter:
135 UDP, 139 TCP, 445 TCP og 593 TCP. Også port 69 UDP og port 4444
TCP kan eventuelt misbruges.
Jeg vil råde alle til straks at installere patchen hvis de ikke har
gjort det, installere en Firewall (Sygate Personal firewall er gratis)
og holde deres antivirus program opdateret.
Her er en nærmere analyse:
FYI:
The ISS X-Force info on the worm is at:
http://xforce.iss.net/xforce/alerts/id/150
The ISS X-Force info on the vuln is at:
http://xforce.iss.net/xforce/alerts/id/147
Our X-Force guys think that the percentages mentioned in Symantec's
advisory are reversed. We think the worm targets 80% WinXP, 20% Win2k
(rather than the other way around). Not that this matters a lot, but I
thought I'd mention it.
Note that the worm has done a lot to severely slow down its progress:
1. it DoSes lots of potential victims (because of the WinXP vs. Win2k
problem); other exploits exist that do some fingeprinting of the MSRPC
stack before attacking
2. it does sequential scans, which is actually a lot worse than random
scans for fast propagation
3. it only has 20 "threads" of execution -- taking advantage of raw
sockets would have been much worse (the Internet would have been
"slammed")
4. it only uses the ISystemActivator interface on port 135; my scans
show a lot of vulnerable systems still out there that have other ports
or other DCOM interfaces exposed
5. it uses two separate connections (4444/tcp and 69/udp) to
completely
break into the target system, which is blocked by lots of firewalls,
which means the service is DoSed without getting infected. If the
hacker
had used a trick like CodeRed to combine everything in the original
connection, things would have been much worse.
In other words, this is pretty much a "best-case-scenario" worm --
many
of us had expected much worse.
Symantec includes a Snort-like signature for their IDS in their
advisory. I'd like to point out that the RealSecure/BlackICE signature
for this vuln is "MSRPC_RemoteActivate_BO". We've had this deployed in
our MSS operations for since July 17th, and haven't found any
false-positives. The sig is based on a full protocol-analysis, so
there
shouldn't be any false-negatives, either.
Regards Jens Peter Karlsen. Microsoft MVP - Frontpage.
On Mon, 11 Aug 2003 23:23:50 +0200, Lars Stokholm <monospam@mail.dk>
wrote:
>Jeg har, længe inden alt det her postyr, lukket for port 135, som er
>den port RPC udnyttes på. Jeg har derfor aldrig været i farezonen.