Re: DoS worm

[Nick FitzGerald <nick () virus-l demon co uk>]

David Gillett wrote:

<<snip>>
> 3.  Probe random addresses in our Class B space (port 445, CIFS);
> if it got a connection, it tried various SMB-type things amongst 
> which I was able to pick out the string "IPC".  Five other machines
> in our space eventually demonstrated similar symptoms.
>
>   I don't know what this beast is.  I infer that #2 is a DoS attack
> which is perhaps the purpose of the worm, and that #3 is its spread
> vector via the IPC$ share.
>
>   Anybody recognize this?

One of several relatively common worms that spread via simple CIFS 
password bruteforcing (possibly among other things...).  The boxes that 
were "hacked" will have had (mainly) trivial administrator passwords of 
the "admin", "qwerty", "12345", "aaaaa", etc varieties.

Just more evidence of why the LAN should normally be treated as a 
hostile network unless you have smartly managed switches with MAC-level 
access and network configuration control.  With the right equipment and 
a bit of thought you can easily set things so "unknown" machines either 
get no netwrok access at all, or are stuck into a very limited VLAN 
with very limited off-site access via the border firewalls.  Sadly, 
such configurations are not that common due to a lack of will or 
expertise or <insert preferred cause celebre>.


Regards,

Nick FitzGerald