Three major Beagle variants in one day

Friday was a busy day for all security administrators who provide AV protection as at least 3 new variants were discovered.  In some cases multiple updates were applied corporately in the same day, as F-Secure declared Friday as “Bagle Day”    

http://isc.sans.org//diary.php?date=2004-10-29

http://www.f-secure.com/weblog/  

	W32.Beagle.AV@mm
	W32.Beagle.AW@mm
	W32.Beagle.AU@mm
	W32.Beagle@mm!cpl

Electronic Voting - The need for the highest levels of security

As we approach our national election, our area will be moving from the lever based voting machines to PC based touch screen voting.  Technology can be beneficial a I hope security has been thought out properly.  For example, every election PC should be standalone and not connected to the Internet or any network.  It will need transactional shadowing to backup each vote in case of a technical malfunction.  In other words, electronic voting issues needs Fort Knox security, 100% reliability, and best audit practices (e.g., separation of duties, autonomy levels, tight balancing controls, etc).  I'm hoping the process will go well and with good accuracy this year.

New Bagle Variant - Medium Risk by Secunia

  McAfee issued the medium alert due to prevalence. Secunia, Trend, and F-Secure have also issued MEDIUM RISK warnings.

W32/Bagle.BB - MEDIUM RISK (DAT 4402 required)
http://vil.mcafeesecurity.com/vil/content/v_129509.htm

New Bagle Variant - Medium Risk by Secunia
http://secunia.com/virus_information/13033/bagle.at/
http://www.sarc.com/avcenter/venc/data/w32.beagle.au@mm.html
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_BAGLE.AT
http://www.f-secure.com/v-descs/bagle_at.shtml
http://www3.ca.com/threatinfo/virusinfo/virus.aspx?id=40589
http://www.pandasoftware.com/virus_info/encyclopedia/overview.aspx?IdVirus=53891&sind=0

MS04-011: Korgo.V - Medium Risk by Secunia

Fake Redhat Security Advisory Circulating

   Please never update by email as it's likely to be virus infected. All vendors require downloads from their website to ensure safety and never distribute patches by email.

Fake Redhat Security Advisory Circulating
http://www.redhat.com/security/
http://isc.sans.org//diary.php?date=2004-10-24

23rd October 2004 -- Red Hat has been made aware that emails are circulating that pretend to come from the Red Hat Security Team. These emails tell users to download and run an update from a users home directory. This fake update appears to contain malicious code. Official messages from the Red Hat security team are never sent unsolicited, are always sent from the address secalert@redhat.com, and are digitally signed by GPG. All official updates for Red Hat products are digitally signed and should not be installed unless they are correctly signed and the signature is verified.

Analysis of the Attack

http://www.k-otik.com/news/FakeRedhatPatchAnalysis.txt

How AV vendors look at and categorize New Viruses

F-Secure's weblog entry shows the code design and structure for a virus with comparisons of similar and dissimilar designs.  Intially, the Buchon virus was thought to be part of the Netsky family but after modeling the code it is now a brand new virus family. 

http://www.f-secure.com/weblog/#00000321

Security Report: Windows v. Linux (33 pages)

This report provides in-depth technical and security information on each operating system.

Security Report: Windows  v. Linux  
Security Report: Windows v. Linux (33 pages)

MS04-032: Ecommander Backdoor (attacks unpatched Windows systems)

  An MS04-032 proof-of-concept exploit has become a real one. Thankfully, it is not widespread but it provides a new method of attack on unpatched systems. Everyone is encouraged to complete Windows Updates as soon as they can

MS04-032: Ecommander Backdoor
http://www.symantec.com/avcenter/venc/data/backdoor.emcommander.html

Backdoor.Emcommander is a Backdoor Trojan distributed as an EMF image file. It exploits the Microsoft Windows WMF/EMF Image Format Rendering Remote Buffer Overflow Vulnerability (described in Microsoft Security Bulletin MS04-032) and allows an attacker to control the compromised system.

Opens a backdoor on TCP port 31337 and listens for commands from an attacker. The port number may vary because Backdoor.Emcommander can be built with a Backdoor.ConstructKit tool, where the port number can be specified as a parameter. Executes the remote command sent by the attacker through the Internet. The remote command is executed through "cmd.exe" of the compromised system

Quantitative Study of Firewall configuration errors

CWS Shredder 2.0 is now available from InterMute

   CWShredder Version 2.0 is now available as a free cleaning tool against the latest CoolWebSearch variants.

What's New With CWShredder?

Originally developed by Merijn Bellekom of the Netherlands, CWShredder is now owned and maintained by InterMute. CWShredder has been updated to include new CoolWebSearch variants. Use in conjunction with SpySubtract for the strongest defense against Spyware threats.

CWShredder Version 2.0
http://www.intermute.com/spysubtract/cwshredder_download.html

MS Security Bulletins Oct 2004 - Trend Micro's summary

  Trend Micro provides an excellent summary and assessment of the Microsoft vulnerabilities published by Microsoft on October 12, 2004:

• MS04-029_RPC_RUNTIME_LIBRARY
• MS04-030_WEBDAV_XML
• MS04-031_NETDDE
• MS04-032_MICROSOFT_WINDOWS
• MS04-033_MICROSOFT_EXCEL
• MS04-034_COMPRESSED_FOLDERS
• MS04-035_SMTP
• MS04-036_NNTP
• MS04-037_WINDOWS_SHELL
• MS04-038_INTERNET_EXPLORER

Microsoft Bulletins for October

W32.Mydoom.AF@mm - new variant

MS04-028: Corporate Scanning Tool Links

Enterprise Update Scanning Tool for Bulletin MS04-028
http://www.microsoft.com/downloads/details.aspx?FamilyID=70e1c04d-47e2-4ea6-a638-11ab6ad9bd6e&DisplayLang=en

This tool is a command line scanning tool built for the sole purpose of helping customers determine systems that may need security updates provided with the MS04-028 bulletin http://www.microsoft.com/technet/security/bulletin/ms04-028.mspx .

Users of this tool should have experience in deploying software to corporate environments and with using command line tools. More information on this tool can be found in the Knowledge Base article 886988 (KB886988)
How to obtain and use the MS04-028 Enterprise Update Scanning Tool in environments that do not use Systems Management Server http://support.microsoft.com/?id=886988

SMS MS04-028 Update Scan Tool
http://www.microsoft.com/downloads/details.aspx?FamilyID=c4745685-9521-4b63-a338-0b3e2dcbf2bb&DisplayLang=en

This tool is a scan tool built for the sole purpose of helping customers determine SMS client computers that may need security updates provided with the MS04-028 bulletin. Like MBSA, this tool also has the instructions for SMS to locate each applicable update and download it from Microsoft.

MS04-036: NNTP Proof of Concept exploit developed

  Please update Windows and Office products with the latest security updates to ensure the best levels of protection as active development of exploits continues.

MS04-036: NNTP Proof of Concept exploit developed
http://isc.sans.org//diary.php?date=2004-10-15

If you were wondering how quickly you needed to apply the patches that Microsoft released a couple of days ago, please keep in mind that proof-of-concept exploit code for the Windows NNTP vulnerability (MS04-036) is publicly available. The recent Core Security advisory includes the exploit code, and provides detailed technical information about the vulnerability, which they seem to have reported to Microsoft in mid-August.

The Core Security advisory was published just hours after the patches became publicly available--this is a good illustration of the rapidly shrinking time window in which you need to apply security patches.

http://www.coresecurity.com/common/showdoc.php?idx=420&idxseccion=10

Netsky AG - New variant in-the-wild

  Even though the author has been arrested, cloning of the virus continues on one of the worst email viruses since Klez.H   

As noted, Secunia provides a good summary of all AV vendors (as many have differing suffixes).  Thankfully, this new variant remains low-risk by most AV vendors currently. 

Secunia Information
http://secunia.com/virus_information/12662/

McAfee - W32/Netsky.ag@MM
http://vil.nai.com/vil/content/v_128905.htm

Symantec - W32.Netsky.AD@mm (currently rated Level 2)
http://www.sarc.com/avcenter/venc/data/w32.netsky.ad@mm.html
This variant of W32/Netsky is similar to previous variants. It bears the following characteristics:

* constructs messages using its own SMTP engine
* harvests email addresses from the victim machine
* spoofs the From: address of messages

Avoid all EMAIL attachments that end as follows:

• .pif
• .com
• .scr
• .bat
• .zip

OCTOBER 2004 - MICROSOFT SECURITY BULLETINS

 There are 10 updates for October (7 Critical and 3 Important)

OCTOBER 2004 - MICROSOFT SECURITY BULLETINS
http://www.microsoft.com/technet/security/Bulletin/ms04-oct.mspx

3 BULLETINS RATED AS IMPORTANT

MS04-029 -- Vulnerability in RPC Runtime Library Could Allow Information Disclosure and Denial of Service (873350)

Executive Summary: An information disclosure and denial of service vulnerability exists that could cause the affected system

to stop responding or could potentially read portions of active memory content.

MS04-030 -- Vulnerability in WebDav XML Message Handler Could Lead to a Denial of Service (824151)

Executive Summary:  A Denial of Service vulnerability exists that could cause the affected system to stop responding to requests.

MS04-031 -- Vulnerability in NetDDE Could Allow Remote Code Execution (841533)

Executive Summary:  A remote code execution vulnerability exists in the NetDDE services because of an unchecked buffer.

7 BULLETINS RATED AS CRITICAL

MS04-032 -- Security Update for Microsoft Windows (840987)

Executive Summary: A remote code execution vulnerability, two elevation of privilege vulnerabilities, and a denial of service

vulnerability exist in Windows. The most severe vulnerability could allow remote code execution on an affected system.

MS04-033 -- Vulnerability in Microsoft Excel Could Allow Remote Code Execution (886836)

Executive Summary: A vulnerability exists in Microsoft Excel that could allow remote code execution on an affected system.

MS04-034 -- Vulnerability in Compressed (zipped) Folders Could Allow Remote Code Execution (873376)

Executive Summary: A vulnerability exists in the way that Windows processes Compressed (zipped) Folders that could allow remote code execution on an affected system.

MS04-035 -- Vulnerability in SMTP Could Allow Remote Code Execution (885881)

Executive Summary: A vulnerability exists in the Windows SMTP component and Exchange Server Routing Engine component that could allow remote code execution on an affected system.

MS04-036 -- Vulnerability in NNTP Could Allow Remote Code Execution (883935)

Executive Summary: A vulnerability exists in the Windows NNTP Component that could allow remote code execution on an affected system.

MS04-037 -- Vulnerability in Windows Shell Could Allow Remote Code Execution (841356)

Executive Summary: A vulnerability exists in the way that the Windows Shell launches applications. A vulnerability exists in Program Group Converter because of the way that it handles specially crafted requests. Both could allow remote code execution on an affected system.

MS04-038 -- Cumulative Security Update for Internet Explorer (834707)

Executive Summary: Five remote code execution and three information disclosure vulnerabilities exist in Internet Explorer.

W32/Funner.worm (avoid FUNNY.EXE in MSN IM)

  This new virus is spreading in the MSN Messenger environment and please avoid all Instant Messages that offer downloading of FUNNY.EXE

W32/Funner.worm (avoid FUNNY.EXE in MSN IM)
http://secunia.com/virus_information/12581/funner/
http://vil.nai.com/vil/content/v_128750.htm
http://www.sarc.com/avcenter/venc/data/w32.funner.html

W32.Funner is a worm that spreads using Microsoft's Windows Messenger instant message program and modifies the hosts file.  It may download other components and files from another web site. 

Corporate Laptop and Notebook Security

   Unfortunately laptop and notebook theft is a TOP security exposure.  The following are some ideas for improved corporate security:

1. The likelihood of laptop theft increases dramatically during travel.  If the remote office has empty available workstations and the user doesn't need a laptop outside the office, they can place their documents & work files on the network and avoid traveling with it.

2. Make sure the user checks it in with hotel security when practical if they will be gone for a long period of time.

3. Data encryption should be used on sensitive and confidential files.

4. Tactifully emphasize to traveling professionals how prevelant laptop theft is (e.g., include articles on website or feature in company newsletter). 

5. Label laptops with company identification tags (hopefully in a way that might be difficult for the theft to remove/alter). 

6. Include "return information" on the label in case a laptop is lost and not stolen.

7. For laptops with highly confidential information, biometrics, BIOS passwords, SecureID, smart cards, and other 2 factor authentication methods can be used.

SANS: How the top 20 threats in 2004 compare to 2004

The ISC featured these links show the top 20 security threats for 2004 and 2003:

SANS Top 20 for 2004
http://www.sans.org/top20

SANS Top 20 for 2003
http://www.sans.org/top20/top20_oct03.php

F-Secure: Updated information on GDI+ JPG vulnerabilities

   F-Secure which provides excellent AV products shares a good update on the gdiplus.dll vulnerabilities associated with malformed JPEGs. 

http://www.f-secure.com/weblog/

Renewed notice on the GDI+ JPG vulnerability - (Oct 5th)

We've posted another notice on the JPG vulnerability, trying to get people to patch before it's too late.

Couple of notices on this vulnerability:

- Filtering files with .JPG extension won't protect you much. Bad JPGs can be renamed to .BMP or even .ICO and they still work fine

- To update Word, Excel and other Office tools, most users need to visit officeupdate.microsoft.com - but keep your Office installation CD handy!

- In some cases, Internet Explorer will run into the vulnerability before it has saved the offending JPG file to the IE cache folder - which means most workstation antivirus products won't have a chance to scan it before it's too late. Gateway-based antivirus scanners (like F-Secure Internet Gatekeeper) take care of this problem

- However, exploiting Internet Explorer with this vulnerability seems to be particularily hard. Exploiting Windows XP's EXPLORER.EXE while viewing local JPG files is much easier and several toolkits to create JPGs like this exist. This reduces the likelyhood of appereance of a massmailer worm using this vulnerability

- Finally, if you scan JPGs with this exploit embedded in them, F-Secure Anti-virus will detect them

For more, see our description.