OT: RPC Service Shutdown = BLaster Worm

[Thermodyne]

OK, here is a little update. It looks like it got set loose by hacking a backbone switch. And uses a port that is usually open on firewalls.

_______________________________________________

BLaster worm continues to cause Microsoft Windows havoc

Thing continues to proliferate

By INQUIRER staff: Wednesday 13 August 2003, 10:52

NO-ONE IS entirely sure how many Windows 2000 and XP machines have been infected by the backdoor BLaster/LovScan worm since it emerged at the start of the week but estimates range in the hundreds of thousands so far.
But one senior US support technician, speaking to the INQ on terms of anonymity, said that the extent of the problem is greater than virus firms have so far estimated.

Despite being described by Symantec and other anti-virus firms as being "badly written", he told us today: "Whoever made this thing deserves a pat on the back. It completely goes around most forms of existing Windows security".

It does appear to have affected individuals and small businesses, rather than large corporations, mostly because many people are unaware of the type of things you need to do these days to protect yourself.

Not only do we have viruses and worms, machines can be affected and slowed down by spyware, by Messenger-inspired pop-ups. And then there's spam.

While Microsoft did notify that a security hole in its software should be patched on July 16th, it seems many people didn't bother to do so. The problem is that Microsoft regularly issues so many patches that inexperienced Users may not realise they need to download them.

It's not just inexperienced Users, however. Many large corporations and organisations have policies about patches, recognising that it's unrealistic to upgrade or "patch" hundreds or perhaps thousands of machines. Even large ISPs failed to patch a gaping hole exploited by SQL Slammer earlier this year, causing widespread downtime further down the line.

The technician claimed that someone had hacked a high level internet switch at Genuity, a large backbone provider in the USA.

The worm, he said, spreads using Remote Administration. Windows 2000 and Windows XP automatically accepts remote administration commands from switches, routers and hubs. He claimed that in his office, also located in the USA, got 12,000 calls from XP Users in California alone – an extra 40 calls per agent per shift.

The worm itself is relatively easy to destroy, once Users have figured out what the problem is. But it doesn't always show the same symptoms to the same user, meaning that it can take a while for Users to realise that it's an infection, and not just a problem with the operating system itself. µ

[Richard]

Originally posted by cybersol:

quote:

---

Originally posted by Suicide Junkie:
A firewall or router would have protected you, as well.

Or, just NOT having windows NT/2000/XP installed would work too.

If the firewall had the following features active before initial infection then it would offer good protection:

From the symantec site:
Block access to TCP port 4444 at the firewall level, and then block the following ports, if they do not use the applications listed:

TCP Port 135, "DCOM RPC"
UDP Port 69, "TFTP"

Obviously, if the firewall did not protect those ports then it wouldn't help. Also if the virus was introduced behind the firewall (wired laptop for instance) then the firewall wouldn't help. Finally, because of the future threat of copycat worms it is best to run the Microsoft security update that Thermodyne and I gave links to in order to close this particular buffer overun issue for good.

I for one am glad the end result of this worm is just rebooting (though that was very annoying at the time) and denial of service attacks. Only HD change was a single additional file and registry entry.

Also note that 2000 Users could have this worm and under default OS settings they would not have the constant re-booting behaivor that happens on XP. Updating your virus definitions and microsoft patches just in case could not hurt

---

Actually most end user firewalls should protect them out of the box, unless they opened something manually.