bugtraq - RE: Will the Sasser worm become the next Blaster?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <56FAB220E3FB16479E534F585D90E3090919AC2D@dalexu02.exchange.acsad.acs-inc.com>
Date: Mon, 3 May 2004 15:01:38 -0500
From: "Pullum, Stephen" <Stephen.Pullum@...-inc.com>
To: kers0r <root@...lum-nz.com>, bugtraq@...urityfocus.com
Subject: RE: Will the Sasser worm become the next Blaster?

>From lurhq.com...

Update: May 3, 2004 
The authors of the Netsky virus have claimed authorship of Sasser in
comments included in the code of Netsky.AC. They provide a snippet of source
code as proof. LURHQ has also independently compared the binary code of both
Sasser and Netsky and found other evidence supporting a common source code
base in the two programs. Therefore the claim of "Team Skynet" appears to be
credible. 

Like Netsky, new variants of Sasser are being released quickly. As of this
writing, four variants have been uncovered: 

Variant Size MD5 Executable Compile Date 
A 15,872 a73c16ccd0b9c4f20bc7842edd90fc20 avserve.exe Fri Apr 30 19:23:16
2004 
B 15,872 1a2c0e6130850f8fd9b9b5309413cd00 avserve2.exe Sat May 1 07:39:48
2004 
C 15,872 831f4ee0a7d2d1113c80033f8d6ac372 avserve2.exe Sat May 1 14:07:32
2004 
D 16,384 03f912899b3d90f9915d72fc9abb91be skynetave.exe Sun May 2 10:53:43
2004 

Differences between variant A and B were changes to the code to implement a
psuedo-forking mechanism when exploiting hosts. Variant C changed the number
of scanning threads to 1024 instead of 128. Variant D changed the number of
scanning threads back to 128 and implemented a ICMPSendEcho API call prior
to connecting to a host via TCP in order to speed up scanning (much in the
same way the Welchia worm does). Due to a bug, the D variant does not appear
to run on Windows 2000, so an E variant may be forthcoming shortly. 

-----Original Message-----
From: kers0r [mailto:root@...lum-nz.com] 
Sent: Saturday, May 01, 2004 8:30 PM
To: bugtraq@...urityfocus.com
Subject: Will the Sasser worm become the next Blaster?

The LSASS Sasser worm is spreading through the documented MS04-011 (LSASS)
vulnerability. Presently this worm has not gotten to plague proportions but
statistically it may well. 

Apart from the Sasser worm problem, there also remains the problem of human
hackers exploiting this hole. Warez ftp hackers have already started using
an exploit targeting unpatched systems creating "pubstro" warez dumps. The
DCOM vulnerability saw numerous script kiddie tools created that allowed
trojan hackers to upload and run trojan servers, will we see another wave of
tools being created? 

-----------------------------------

Jonathan Read (aka kers0r)

http://www.anti-trojan.org