Security Watch: New Worm Hits Windows Hole in Record Time
ARTICLE DATE: 08.15.05
By
Larry Seltzer,
eWEEK
The Watch
It didn't take long: less than a week after Microsoft revealed a serious vulnerability in the Plug and Play service, worms were out on the Internet exploiting it. See how to identify the worms in <ZIFFARTICLE id=158096 page="2">this week's Top Threat section</ZIFFARTICLE>.
Spam, worms, DDOS attacks and many of the other ills that plague us are perpetrated through botnets. Whose networks are these botnets on? We name names in <ZIFFARTICLE id=158096 page="3">the Top Botnets section</ZIFFARTICLE>.
The Plug and Play vulnerability was a biggie, but it wasn't the only big deal this week. See all the other problems you should be addressing in <ZIFFARTICLE id=158096 page="4">the Top 5 Vulnerabilities section</ZIFFARTICLE>.
When you get a text e-mail, you might feel secure about it because it doesn't have any of that HTML nonsense in it, but is it really text? Things are not always what they seem, as we demonstrate in <ZIFFARTICLE id=158096 page="5">this week's Top Phish</ZIFFARTICLE>.
How do you identify a phishing attack? One way is to take advantage of a feature your e-mail client probably has. See what it is and how to do it in <ZIFFARTICLE id=158096 page="6">this week's Security Tip</ZIFFARTICLE>.
Since it's the most feared of last week's disclosed Windows vulnerabilities, this week we take a more detailed look at the Plug and Play vulnerability in the Security Alerts and Updates section.
Large corporations, universities and ISPs all have an ASN assigned to them. Find out what it is in <ZIFFARTICLE id=158096 page="8">Jargon Watch</ZIFFARTICLE>.
A Florida man stole 1.5 billion data files. Find a news story about this and other topics in <ZIFFARTICLE id=158096 page="9">the Security Watch Story Feed</ZIFFARTICLE>.
<ZIFFPAGE title="Top Threat: Zotob.a, Zotob.b">
Top Threat:Zotob.a, Zotob.b
Executive Summary
Name: Zotob.a,
Zotob.b (Symantec)
Affects: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP,
but Windows 2000 most seriously
What it does: Perhaps the most serious of the vulnerabilities that Microsoft announced last week,
MS05-039 (Vulnerability in Plug and Play Could Allow Remote Code Execution and Elevation of Privilege) affects Windows 2000 systems most seriously.
Zotob.a and Zotob.b are the first variants of a new worm which uses the MS05-039 vulnerability as a means of propagation. For more on this vulnerability, see <ZIFFARTICLE id=158096 page="7">the Security Alerts and Updates section</ZIFFARTICLE>.
When the worm executes, the first thing it does is to check for the existence of and then, if not found, create a mutex (also known as a semaphore) on the system named 'B-O-T-Z-O-R'. This prevents more than one copy of the worm from running at any one point.
Zotob.a then makes a copy of itself on the system named %System%\botzor.exe. Zotob.b copies itself as %System%\csm.exe. Then it adds the appropriate value to the
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
and
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersionRunServices
registry keys:
- "WINDOWS SYSTEM" = "botzor.exe"
or
- "csm Win Updates" = "csm.exe"
It then sets the value:
in the registry key
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
SharedAccess
in order to disable Windows Shared Access service.
Now things get really nasty. The worms connect to IRC servers on TCP port 8080 to allow for unauthorized remote access to the system. Zotob.a and Zotob.b use different servers. For similar reasons it also opens an FTP server on TCP port 33333.
It now generates a random IP address in its subnet in order to attack computers at that address using the MS05-039 vulnerability. Once the system is compromised, it runs an FTP script named %System%\2pac.txt. This downloads (as %System%\haha.exe) and executes a copy of the worm from the attacking computer.
Finally, it adds a taunt to the HOSTS file, followed by entries meant to disable access to a number of security-related sites and other innocent victims, including eBay and PayPal:
