TaoSecurity Blog

I'm very pleased to share news of an awesome new book titled Practical Malware Analysis by Michael Sikorski and Andrew Honig. The authors will present a Webinar on their book on Wednesday 29 February at 2 pm eastern. I was pleased to write the foreword, which ends with these words: If the malware authors are ready to provide the samples, the authors of the book you’re reading are here to provide the skills. Practical Malware Analysis is the sort of book I think every malware analyst should keep handy. If you’re a beginner, you’re going to read the introductory, hands-on material you need to enter the fight. If you’re an intermediate practitioner, it will take you to the next level. If you’re an advanced engineer, you’ll find those extra gems to push you even higher—and you’ll be able to say “read this fine manual” when asked questions by those whom you mentor. Practical Malware Analysis is really two books in one—first, it’s a text showing readers how to analyze modern malw...

I just read Experimental Storm Worm DNS Blocklist at SANS. The result of such a scheme looks something like this: richard@neely:~$ host basic1.threatstop.com ;; Truncated, retrying in TCP mode. basic1.threatstop.com has address 221.208.208.28 basic1.threatstop.com has address 221.208.208.27 basic1.threatstop.com has address 221.208.208.26 basic1.threatstop.com has address 221.208.208.25 basic1.threatstop.com has address 221.208.208.24 basic1.threatstop.com has address 221.208.208.23 basic1.threatstop.com has address 221.208.208.22 basic1.threatstop.com has address 221.208.208.21 basic1.threatstop.com has address 221.208.208.20 basic1.threatstop.com has address 221.208.208.19 basic1.threatstop.com has address 221.208.208.18 basic1.threatstop.com has address 221.208.208.17 basic1.threatstop.com has address 221.208.208.16 basic1.threatstop.com has address 221.208.208.15 basic1.threatstop.com has address 221.208.208.14 basic1.threatstop.com has address 221.208.208.13 basic1.threatstop.co...

One of the reasons I blog is to record concrete events so I can more easily reference the exact details in the future. In Black Hat USA 2007 Round Up Part 2 I said: Modern countermeasures applied to reduce vulnerability and/or exposure in many cases increase both vulnerability and exposure. This is certainly the case with so many agents (see Matasano is Right About Agents .) Sometimes these vulnerabilities are present in the agent itself, such that the agent can be directly attacked. In other cases (like the one I cite today), the agent appears to re-introduce a vulnerability that the underlying system fixed years ago . From Haxdoors of the Kaspersky Antivirus 6/7 : Kaspesky [sic] and System Service Descriptor Table Very long time is known that this is the weakest part of this antivirus. The weakest, because it contains number of elementary bugs. Another example of poorly coded so-called Proactive Defense. On Windows XP Kaspersky AV adds additional services in SSDT table... And no...

During my classes I mentioned seeing a post on malware that performs ARP spoofing to inject malicious IFRAMEs on Web pages returned to anyone browsing the Web on the same segment. I found it -- ARP Cache Poisoning Incident by Neil Carpenter. Thanks to Earl Crane for taking the picture of a few ex-Foundstoners who met after the talk by Keith Jones and Rohyt Belani.

In February I blogged about a vulnerability in a Trend Micro product that exposed systems "protected" by this anti-virus software to remote exploitation. Symantec provides another example that running anti-virus is not cost free : Symantec false positive cripples thousands of Chinese PCs . Now, according to Symantec may compensate Chinese users hit by buggy update , Symantec may pay companies affected by its botched signature update. Trend Micro apparently had a similar problem in 2005, before I was blogging about these dangers; it cost TM $8.2 million. Please keep these stories in mind when you hear people claim that adding any security software to a system is automatically good and justified because of "defense in depth." On a related note, this story pointed me towards the English language edition of the Chinese Internet Security Response Team blog .

Renowned botnet hunter Gadi Evron posted a message titled mitigating botnet C&Cs has become useless to several newsgroups. His post is a little tough to follow, but it seems his main point is it's too easy for intruders to establish new command and control networks. The good guys can't shut down the C&C networks fast enough to make a difference. Paul Vixie extended this argument in 2004 in his Superbugs story. He said "Stomping a botnet is actually a bad thing to do. Read that again. Please." Vixie argues that shutting down simple C&C networks forces intruders to elevate their game. I'm not sure what I should think about this issue. Paul Vixie, and definitely Gadi Evron, know far more about botnets than I do. However, I'm not sure that I can accept their argument about slowing down the digital arms race. I agree that confronting the intruders as directly as possible, though law enforcement, is the best course of action. On the other ha...

I'd like to congratulate the United States Attorney's Office, Central District of California for indicting a bot net controller. According to the press release and the indictment (.pdf), up to 400,000 victims were compromised. You can track the progress of this case through the Post Indictment Arraignment Calendar . This is exactly the sort of work that needs to be done. Security professionals cannot win against intruders if only the "vulnerability" variable of the risk equation is addressed. We need law enforcement to reduce the "threat" variable as well. The suspect in this case is a 20-year-old living in California. This is the sort of perpetrator who can be deterred, unlike a foreign intelligence agent or member of organized crime. The more bot net operators who are put in jail, the fewer lower-end threats we will need to stop.

This article describes the Common Malware Enumeration project. CME is a sister project to Mitre's Common Vulnerabilities and Exposures (CVE) initiative. CME will "assign unique identifiers to high priority malware events." This is a great idea, because anti-virus vendors, security researchers, and OS/application vendors will be able to refer to a common name rather than their internal representations for malware. DHS is funding the CME project.

I found Ryan Naraine's article From Melissa to Zotob to be a good summary of popular worms of the last few years. I remember Melissa as a real wake-up call for the community. It hit on a Friday night, and the following Saturday morning my (soon-to-be) wife and I were getting engagement photos taken. My commanding officer called during the photo session and said all officers were being recalled to the AFCERT to "fight" the worm. That was an interesting weekend! A comment in the latest SANS NewsBites by editor Rohit Dhamankar on Zotob makes a good point: "The time from vulnerability announcement to release of [the Zotob] worm was one of the shortest seen in recent times. Patch announced August 9th (Tuesday); exploit code posted publicly August 11th (Thursday); worm started to hit on August 13th (Saturday). Because [these] worms spread over 139/tcp or 445/tcp, [these] ports that cannot be firewalled without breaking some functionality in Windows environment. That...

The SANS ISC is reporting that a worm which exploits the Plug and Play (PnP) vulnerability described by MS05-039 is in the wild. The F-Secure Blog reports the worm is called Zotob . The Microsoft bulletin lists three mitigating factors: On Windows XP Service Pack 2 and Windows Server 2003 an attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. The vulnerability could not be exploited remotely by anonymous users or by users who have standard user accounts. However, the affected component is available remotely to users who have administrative permissions. On Windows XP Service Pack 1 an attacker must have valid logon credentials to try to exploit this vulnerability. The vulnerability could not be exploited remotely by anonymous users. However, the affected component is available remotely to users who have standard user accounts. Firewall best practices [e.g., blocking SMB ports] and standard default firewall configurations can help ...

Wednesday I reported the publication of an exploit for the FTP service used by the Sasser worm . Now there's a new worm called Dabber exploiting the same vulnerability in Sasser's FTP service. Read each link for LURHQ 's analysis of each worm. If you've been seeing increased scans to ports 9898 and 5554 TCP, you'll know why after reading the advisories. Port 5554 TCP is the Sasser FTP server. Port 9898 is the Dabber back door.

We've heard of intruders exploiting systems already infected by worms, but this is another way to take advantage of poorly deployed systems. A Romanian coder released sasserftpd.c recently. This code attacks the FTP server used by Sasser to propogate. The rogue Sasser FTP server listens on port 5554 TCP on versions a through d and port 1023 TCP on version e. The Romanian exploit attacks this FTP server.

I just heard about a thread on NTBugTraq regarding the presence of a kernel level driver called ierk8243.sys . This might be evidence of a trojan related to the MS-SQL "Slammer" worm. Check the thread for more info. I can't find anything else publicly available, yet.

I just finished listening to the SANS webcast on the recent 1434 udp traffic. It's worth a background listen and lasts one hour.

Looks like the Internet is weathering a new worm. Check out Internet Health Report to see that UUNet appears worse affected at the moment. Details on the vulnerability are available from CERT/CC . eEye has a good write-up and a disassembly . Cisco offers defensive measures. You can find reachability and packet loss graphs at Matrix.net .