The MS Blaster worm Presented by: Zhi-Wen Ouyang.

Slides:

Advertisements

Similar presentations

Thank you to IT Training at Indiana University Computer Malware.

Advertisements

1 Computer and Internet Security JCCAA Presentation 03/14/2009 Yu-Min (Phillip) Hsieh Sr. System Administrator Information Technology Rice University.

Lecture: Malicious Code CIS 3360 Ratan K. Guha. Malicious Code2 Overview and Reading Assignments Defining malicious logic Types Action by Viruses Reading.

CHAPTER 2 KNOW YOUR VILLAINS. Who writes it: Malware writers vary in age, income level, location, social/peer interaction, education level, likes, dislikes.

Vulnerabilities of Windows XP Brock Prince Dana Zottola ECE 578 Spring 2002 C.K. Koc.

Hacker, Cracker?! Are they the same? No!!! Hacker programmers intensely interested in the arcane and recondite workings of any computer operating system.

Exploits Dalia Solomon. Categories Trojan Horse Attacks Trojan Horse Attacks Smurf Attack Smurf Attack Port Scan Port Scan Buffer Overflow Buffer Overflow.

Computer Security Fundamentals by Chuck Easttom Chapter 4 Denial of Service Attacks.

Software Security Threats Threats have been an issue since computers began to be used widely by the general public.

CERT ® Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh, PA The CERT Coordination Center is part of.

 Population: N=100,000  Scan rate  = 4000/sec, Initially infected: I 0 =10  Monitored IP space 2 20, Monitoring interval:  = 1 second Infected hosts.

1 Pertemuan 05 Malicious Software Matakuliah: H0242 / Keamanan Jaringan Tahun: 2006 Versi: 1.

Protecting Yourself Online. VIRUSES, TROJANS, & WORMS Computer viruses are the "common cold" of modern technology. One in every 200 containing.

Computer Security and Penetration Testing

How to Own the Internet in your spare time Ashish Gupta Network Security April 2004.

Internet Quarantine: Requirements for Containing Self-Propagating Code David Moore et. al. University of California, San Diego.

Internet Relay Chat Security Issues By Kelvin Lau and Ming Li.

Internet Relay Chat Chandrea Dungy Derek Garrett #29.

2009/9/151 Rishi : Identify Bot Contaminated Hosts By IRC Nickname Evaluation Reporter : Fong-Ruei, Li Machine Learning and Bioinformatics Lab In Proceedings.

DDoS Attack and Its Defense1 CSE 5473: Network Security Prof. Dong Xuan.

Common forms and remedies Neeta Bhadane Raunaq Nilekani Sahasranshu.

How do worms work? Vivek Ramachandran Nagraj – An Indian comic book hero, who commands all the snakes of the world.

Microsoft October 2004 Security Bulletins Briefing for Senior IT Managers updated October 20, 2004 Marcus H. Sachs, P.E. The SANS Institute October 12,

China Science & Technology Network Computer Emergency Response Team Botnet Detection and Network Security Alert Tao JING CSTCERT,CNIC.

MSIT 458 – The Chinchillas. Offense Overview Botnet taxonomies need to be updated constantly in order to remain “complete” and are only as good as their.

Roshan Newa Saransh Chauhan. About Windows XPerience  first consumer oriented OS built on Windows NT kernel  first released on 25 October 2001  Improved.

W HAT DOES EXPLOIT MEAN ? A ND THE S ASSER WORM Seminar on Software Engineering, Short Presentation Christian Gruber.

Administrator Protect against Malware by: Brittany Slisher and Gary Asciutto.

Honeypot and Intrusion Detection System

How CERN reacted to the Blaster and Sobig virus attack Christian Boissat, Alberto Pace, Andreas Wagner.

Active Worms CSE 4471: Information Security 1. Active Worm vs. Virus Active Worm –A program that propagates itself over a network, reproducing itself.

ITIS 1210 Introduction to Web-Based Information Systems Chapter 45 How Hackers can Cripple the Internet and Attack Your PC How Hackers can Cripple the.

1 Vulnerability Analysis and Patches Management Using Secure Mobile Agents Presented by: Muhammad Awais Shibli.

2012 4th International Conference on Cyber Conflict C. Czosseck, R. Ottis, K. Ziolkowski (Eds.) 2012 © NATO CCD COE Publications, Tallinn 朱祐呈.

MyDoom By: Philippe Bissohong. Background ► MyDoom  Novarg, Mimail.R and Shimgapi ► Computer worm, unlike a virus it attacks a network.

--Harish Reddy Vemula Distributed Denial of Service.

The Internet Motion Sensor: A Distributed Blackhole Monitoring System Presented By: Arun Krishnamurthy Authors: Michael Bailey, Evan Cooke, Farnam Jahanian,

EC-Council Copyright © by EC-Council All Rights reserved. Reproduction is strictly prohibited Security News Source Courtesy:

1 Figure 4-16: Malicious Software (Malware) Malware: Malicious software Essentially an automated attack robot capable of doing much damage Usually target-of-opportunity.

Detection Unknown Worms Using Randomness Check Computer and Communication Security Lab. Dept. of Computer Science and Engineering KOREA University Hyundo.

1 CHAPTER 3 CLASSES OF ATTACK. 2 Denial of Service (DoS) Takes place when availability to resource is intentionally blocked or degraded Takes place when.

ANTIVIRUS SOFTWARE.  Antivirus software is the most widespread mechanism for defending individual hosts against threats associated with malicious software,

Presented by: Maha, Marina and Aleks Viruses,Wormsand Trojans.

CHAPTER 3 Classes of Attack. INTRODUCTION Network attacks come from both inside and outside firewall. Kinds of attacks: 1. Denial-of-service 2. Information.

Computer Viruses and Worms By: Monika Gupta Monika Gupta.

1 Figure 4-1: Targeted System Penetration (Break-In Attacks) Host Scanning  Ping often is blocked by firewalls  Send TCP SYN/ACK to generate RST segments.

Understanding Computer Viruses: What They Can Do, Why People Write Them and How to Defend Against Them Computer Hardware and Software Maintenance.

©Ian Sommerville 2004Software Engineering Case Studies Slide 1 The Internet Worm Compromising the availability and reliability of systems through security.

Omar Hemmali CAP 6135 Paul Barford Vinod Yegneswaran Computer Sciences Department University of Wisconsen, Madison.

4061 Session 26 (4/19). Today Network security Sockets: building a server.

Retina Network Security Scanner

Malicious Software.

Open Malicious Source Symantec Security Response Kaoru Hayashi.

Mobile Code and Worms By Mitun Sinha Pandurang Kamat 04/16/2003.

DoS/DDoS attack and defense

Understand Malware LESSON Security Fundamentals.

Slammer Worm By : Varsha Gupta.P 08QR1A1216.

DOS Attacks Lyle YapDiangco COEN 150 5/21/04. Background DOS attacks have been around for decades Usually intentional and malicious Can cost a target.

Page 1 Viruses. Page 2 What Is a Virus A virus is basically a computer program that has been written to perform a specific set of tasks. Unfortunately,

@Yuan Xue Worm Attack Yuan Xue Fall 2012.

Optimization of Blaster worms Performance Evaluation Laboratory s Tatehiro Kaiwa Supervised by Prof. Hiroshi Toyoizumi by Stochastic Modeling.

Microsoft OS Vulnerabilities April 1, 2010 MIS 4600 – MBA © Abdou Illia.

Internet Quarantine: Requirements for Containing Self-Propagating Code

Internet Worm propagation

A Distributed DoS in Action

Internet Worms, SYN DOS attack

Crisis and Aftermath Morris worm.

Introduction to Internet Worm

Presentation transcript:

The MS Blaster worm Presented by: Zhi-Wen Ouyang

Outline General Overview The DCOM RPC Vulnerability How it spreads Other attacks Flaws of MS Blaster A Variant of MS Blaster Removing Instructions Conclusion

General Overview Also known as Lovsan, Poza, Blaster. First detected on August 11, 2003 Exploits the most widespread Windows flaw ever A vulnerability in Distributed Component Object Model (DCOM) that handles communication using Remote Procedure Call (RPC) protocol Affects Windows 2000 and Windows XP Two messages in the code: 1. “I just want to say LOVE YOU SAN!”” 2. “billy gates why do you make this possible? Stop making money and fix your software!!” Infected more than 100,000 computers in 24 hours

The DCOM RPC Vulnerability Detected in mid-July 2003 RPC protocol allow a program to run code on a remote machine Incorrectly handles malformed messages on RPC port 135, 139, 445, 593 Attackers send special message to remote host Gain local privilege, run malicious code

How it spreads Check if computer is already infected Add registry value "windows auto update"="msblast.exe“ to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 60% of the time, generate IP address at random 40% of the time, generates IP addresses of the form A.B.C.0 Increments the last part by 1 each time Use Cmd.exe to create a hidden shell that listens on TCP port 4444

How it spreads (con’t) Send out data on TCP port 135. Send out two types of data 1. data that exploits Windows XP 2. data that exploits Windows 2000 Listen on UDP port 69, send out msblast.exe and execute it on infected computer

Other Attacks Launches DoS on windowsupdate.com 16 th through end of the month of Jan. – Aug. Current month is Sept. – Dec. Flood the website using port HTTP packet every second Each packet is 40 bytes

Flaws of MS Blaster Slowed down the next day Poor programming of the worm Inefficient method to download the code file Infects machines more than once

A Variant of MS Blaster MS Blaster-B Exploits the same vulnerability Minor changes to escape detection A Different file name A Different registry entry More graphic messages Writer is a 18-year-old teenager, Jeffrey Lee Parson, novice code writer, made too many mistakes

Variants of MS Blaster (con’t) 70% unpatched machines since discovery of MS Blaster-B More variants that exploit the same vulnerability: W32.Blaster.C, W32.Blaster.D, W32.Blaster.E, W32.Blaster.F

Removing Instructions Removing tool available for download from Symantec Security Response Instructions 1. terminates MS Blaster worm process 2. delete worm files (“msblast.exe”, “teekids.exe”, “penis32.exe”) 3. deletes dropped files 4. deletes registry values Could manually remove the worm in the same manner

Conclusion Exploits a widespread windows flaw ever Software available today is vulnerable to attacks No significant damages Could have been more effective Better-engineered worms could infected millions of machines in matters of seconds Worms are a serious threat to the safety of the Internet

Thank you Questions?