full-disclosure - smarter dcom worm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <000301c361c9$00df2290$250a640a@navi>
From: gml at phrick.net (gml)
Subject: smarter dcom worm

I think the problem is, that someone was rushing to be the first one out
with a worm.  Anyone can take an exploit and wrap up the main() and write
A worm, it's not that hard.  I think the problem with these worm writers
Is they didn't have the requisite knowledge to actually write a proper worm.
This worm really is nothing spectacular in and of itself, although we cannot
deny its effectiveness.

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Marc Maiffret
Sent: Tuesday, August 12, 2003 7:51 PM
To: Justin Shin; Full-Disclosure@...ts.Netsys.Com
Subject: RE: [Full-Disclosure] smarter dcom worm

You are correct in that "this worm sucks" but I think you could more
eloquently put it as "this is probably the biggest pile of shit glued
together crap ass excuse for a worm" that I've ever seen. >:-] That is NOT
to say it is not being affective and damaging though. It is definitely a bad
one.

I kind of think of this as the "half a worm" since the worm author[s] only
wrote half the worm. The first part, straight rip off of xfocus (with offset
mods) and second part really lame .exe which makes it easy for AV to detect
and stop. A real worm writer wouldn't have used a exploit with static
offsets that sometimes work, they would have kept everything in memory to
screw over AV (for the most part), and tftping a file? wow hahah

If some security companies would not have rushed out non-technical,
substance lacking "analysis", in an effort to be "first" and name the worm
then maybe the worm could have got a more fitting name like the "Craphole"
or "HalfAssed" worm. As "Blaster" sounds too cool for such a pile o ish.

The random IP comment in the beginning of your eMail... while I agree its
spread method is not optimal, your wrong in your statement that its always
random. It actually does use the "local subnet" 40% of the time...

Also tftp/ftp etc... a decent worm would be direct from IP >to> IP, no
retarded connect back to grab your payload stuff. That only makes more
methods of easily filtering the worm.

Signed,
Marc Maiffret
Chief Hacking Officer
eEye Digital Security
T.949.349.9062
F.949.349.9538
http://eEye.com/Retina - Network Security Scanner
http://eEye.com/Iris - Network Traffic Analyzer
http://eEye.com/SecureIIS - Stop known and unknown IIS vulnerabilities

| -----Original Message-----
| From: full-disclosure-admin@...ts.netsys.com
| [mailto:full-disclosure-admin@...ts.netsys.com]On Behalf Of Justin Shin
| Sent: Tuesday, August 12, 2003 3:32 PM
| To: Full-Disclosure@...ts.Netsys.Com
| Subject: [Full-Disclosure] smarter dcom worm
|
|
| As many people have said, this worm sucks. First of all, look at
| the host discovery mechanism. Random IP's are sooooo outdated. A
| better idea? Start with:
|
| 1. Subnet (192.168.x.x)
| 2. WAN Address [for nat's] (24.31.34.x)
| 3. Incremental WAN (24.31.x.x)
|
| Obviously not a new idea but also not a bad one. I am sure that
| your average college-level math professor could simplify the host
| discovery process.
|
| tftp: slow, old, but easy to use. probably straight up ftp would
| be a better dropping protocol, no?
|
| registry/run is the oldest known startup method. try actually
| using MULTIPLE startups, like Registry RunServices, RunOnce,
| RunServicesOnce, AUTOEXEC.BAT, SYSTEM.INI, WIN.INI, WINSTART.BAT,
| WINITIT.INI, CONFIG.SYS ... etc.
|
| once installed, the program should spawn copies of itself, using
| startup methods, hidden files, fake system exes, etc. it should
| block out filenames of patches, windowsupdate stuff, fixes, to
| stop newbies from fixing it.
|
| the worm should also have a more interesting payload -- such as
| lookin at inetpub and htdocs, etc.
|
| note -- im not trying to encourage this stuff, i am just pointing
| out some key flaws in this worm. the next one may have all of
| these features and much more, because I am not a very creative guy.
|
| -- Justin
|
| _______________________________________________
| Full-Disclosure - We believe in it.
| Charter: http://lists.netsys.com/full-disclosure-charter.html
|

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html