full-disclosure - smarter dcom worm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20030813193741.GA8474@squirrelsoup.net>
From: f0x at squirrelsoup.net (Gabe Arnold)
Subject: smarter dcom worm

This is exactly what happened, and I'm sure there are other worms out 
there that are much more silent and much more deadly (in and of themselves and by the fact that they are so silent).  I'd do something that rootkits
 boxes and then patches them so the ugly blaster doesn't crash them. :-.
my 2 centimes.
--Gabe
* gml (gml@...ick.net) 
wrote:
> I think the problem is, that someone was rushing to be the first one out
> with a worm.  Anyone can take an exploit and wrap up the main() and write
> A worm, it's not that hard.  I think the problem with these worm writers
> Is they didn't have the requisite knowledge to actually write a proper worm.
> This worm really is nothing spectacular in and of itself, although we cannot
> deny its effectiveness.
> 
> -----Original Message-----
> From: full-disclosure-admin@...ts.netsys.com
> [mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Marc Maiffret
> Sent: Tuesday, August 12, 2003 7:51 PM
> To: Justin Shin; Full-Disclosure@...ts.Netsys.Com
> Subject: RE: [Full-Disclosure] smarter dcom worm
> 
> You are correct in that "this worm sucks" but I think you could more
> eloquently put it as "this is probably the biggest pile of shit glued
> together crap ass excuse for a worm" that I've ever seen. >:-] That is NOT
> to say it is not being affective and damaging though. It is definitely a bad
> one.
> 
> I kind of think of this as the "half a worm" since the worm author[s] only
> wrote half the worm. The first part, straight rip off of xfocus (with offset
> mods) and second part really lame .exe which makes it easy for AV to detect
> and stop. A real worm writer wouldn't have used a exploit with static
> offsets that sometimes work, they would have kept everything in memory to
> screw over AV (for the most part), and tftping a file? wow hahah
> 
> If some security companies would not have rushed out non-technical,
> substance lacking "analysis", in an effort to be "first" and name the worm
> then maybe the worm could have got a more fitting name like the "Craphole"
> or "HalfAssed" worm. As "Blaster" sounds too cool for such a pile o ish.
> 
> The random IP comment in the beginning of your eMail... while I agree its
> spread method is not optimal, your wrong in your statement that its always
> random. It actually does use the "local subnet" 40% of the time...
> 
> Also tftp/ftp etc... a decent worm would be direct from IP >to> IP, no
> retarded connect back to grab your payload stuff. That only makes more
> methods of easily filtering the worm.
> 
> Signed,
> Marc Maiffret
> Chief Hacking Officer
> eEye Digital Security
> T.949.349.9062
> F.949.349.9538
> http://eEye.com/Retina - Network Security Scanner
> http://eEye.com/Iris - Network Traffic Analyzer
> http://eEye.com/SecureIIS - Stop known and unknown IIS vulnerabilities
> 
> | -----Original Message-----
> | From: full-disclosure-admin@...ts.netsys.com
> | [mailto:full-disclosure-admin@...ts.netsys.com]On Behalf Of Justin Shin
> | Sent: Tuesday, August 12, 2003 3:32 PM
> | To: Full-Disclosure@...ts.Netsys.Com
> | Subject: [Full-Disclosure] smarter dcom worm
> |
> |
> | As many people have said, this worm sucks. First of all, look at
> | the host discovery mechanism. Random IP's are sooooo outdated. A
> | better idea? Start with:
> |
> | 1. Subnet (192.168.x.x)
> | 2. WAN Address [for nat's] (24.31.34.x)
> | 3. Incremental WAN (24.31.x.x)
> |
> | Obviously not a new idea but also not a bad one. I am sure that
> | your average college-level math professor could simplify the host
> | discovery process.
> |
> | tftp: slow, old, but easy to use. probably straight up ftp would
> | be a better dropping protocol, no?
> |
> | registry/run is the oldest known startup method. try actually
> | using MULTIPLE startups, like Registry RunServices, RunOnce,
> | RunServicesOnce, AUTOEXEC.BAT, SYSTEM.INI, WIN.INI, WINSTART.BAT,
> | WINITIT.INI, CONFIG.SYS ... etc.
> |
> | once installed, the program should spawn copies of itself, using
> | startup methods, hidden files, fake system exes, etc. it should
> | block out filenames of patches, windowsupdate stuff, fixes, to
> | stop newbies from fixing it.
> |
> | the worm should also have a more interesting payload -- such as
> | lookin at inetpub and htdocs, etc.
> |
> | note -- im not trying to encourage this stuff, i am just pointing
> | out some key flaws in this worm. the next one may have all of
> | these features and much more, because I am not a very creative guy.
> |
> | -- Justin
> |
> | _______________________________________________
> | Full-Disclosure - We believe in it.
> | Charter: http://lists.netsys.com/full-disclosure-charter.html
> |
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>