ASN.1 vuln, Windows integrity checker
More reports of RBOT using ASN.1 vuln
We are getting more and more reports of the use of the ASN.1 vuln in an rbot variant. This is using one of the ASN.1 vulns patched by MS04-007. The exploit is borrowed from an existing proof of concept. For more discussion see this article on the vuln-
(thanks Dave)
This was previously mentioned in the diary on the 3rd of June as possibly rbot attacking IIS' authentication methods
This is the report from VirusTotal for the samples we've seen:
Antivirus Version Update Result
AntiVir 6.30.0.15 06.05.2005 no virus found
AVG 718 06.04.2005 no virus found
Avira 6.30.0.15 06.05.2005 no virus found
BitDefender 7.0 06.05.2005 Backdoor.SDBot.0B1CDAF0
ClamAV devel-20050501 06.05.2005 no virus found
DrWeb 4.32b 06.05.2005 no virus found
eTrust-Iris 7.1.194.0 06.05.2005 Win32/RBot.121504!Worm
eTrust-Vet 11.9.1.0 06.03.2005 no virus found
Fortinet 2.27.0.0 06.04.2005 suspicious
Ikarus 2.32 06.03.2005 IM-Worm.Win32.Sumom.C
Kaspersky 4.0.2.24 06.06.2005 Backdoor.Win32.Rbot.gen
McAfee 4506 06.03.2005 no virus found
NOD32v2 1.1129 06.05.2005 Win32/Rbot
Norman 5.70.10 06.04.2005 W32/MEWpacked.gen
Panda 8.02.00 06.05.2005 W32/Gaobot.HEG.worm
Sybari 7.5.1314 06.06.2005 Worm.RBot.BGM
Symantec 8.0 06.05.2005 W32.Spybot.Worm
TheHacker 5.8-3.0 06.06.2005 no virus found
VBA32 3.10.3 06.05.2005 Backdoor.Win32.Rbot.gen
Windows Integrity tracking
Having just suffered from a violent system crash, I'm in the perfect place to start tracking everything that is done to my system. My concern is that recently I ended up having to do multiple rebuilds not because I knew my system was compromised but because I couldn't be confident that it wasn't. After running all the rootkit detection tools, AV tools, spyware/adware tools, forensic tools, etc.. that I could find, I still didn't have complete confidence.
So with my nice clean build, I'm setting a goal of having complete tracking of the state of the system. I want to know anything that executes and anything it calls and when anything of that sort changes. I started by looking around for integrity tools and trying to choose one that would make it easy to track all this (cause I'm going to get a lot of noise, I realize that).
Before you ask, yes, I've hardened the build. Yes, I use tools like InControl, the application control built into my personal firewall, WinInterrogator, WinAudit, BHO Demon, AdAware, Spybot S&D, two different AV products, Rootkit Revealer, everything Sysinternals makes, and those are just the ones that come to mind without trying. I've tried everything I can find to track this sort of stuff. None of them give me the level of visibility and assurance I want & need. So, I've been brought to this.
At the moment, the ones I'm trying are Xintegrity Professional and Osiris. Xintegrity offers a free trial and has a clean interface. It seems to crash on occasion but I'm putting up with that for now. Osiris is free and (as far as I know) only offers a command-line interface but that's fine). I've started by building a baseline of the entire system. As I add new software, I'll update the baseline to include the freshly installed software. I'm in the process of identifying the files that are going to change (legitimately) frequently. Once I have those, I'll likely remove most of them from the checks.
Why would I do this? Why not trust my AV software, my personal firewall, my anti-spyware tools, my bootable forensics distro, and everything else? Simply because none of them offer the simple confidence that I want- that I know everything that is going to execute on my system, be it BHO, DLL, EXE, firefox extension, and I want to know when any of them or any of their configurations change. I don't trust my OS, I don't trust any of the software running on it (if the recent months have shown us anything, it is that Firefox has at least as many vulnerabilities showing up as it gains popularity, as IE does), and our tools for dealing with this just seem to stink (or at least fall short of the goal by a good distance).
What do y'all do to help deal with this issue? If there is an interest, I'll post updates in the diary from time to time.
Apple Vulnerability
Finally, Apple has released patches for a whole slew of vulnerabilities:
AFP Server
CVE-ID: CAN-2005-1721
AFP Server
CVE-ID: CAN-2005-1720
Bluetooth
CVE-ID: CAN-2005-1333
CoreGraphics
CVE-ID: CAN-2005-1722
CoreGraphics
CVE-ID: CAN-2005-1726
launchd
CVE-ID: CAN-2005-1725
LaunchServices
CVE-ID: CAN-2005-1723
MCX Client
CVE-ID: CAN-2005-1728
NFS
CVE-ID: CAN-2005-1724
PHP
CVE-ID: CAN-2005-0524, CAN-2005-0525, CAN-2005-1042, CAN-2005-1043
VPN
CVE-ID: CAN-2005-1343
Security Update 2005-006 may be obtained from the Software Update
pane in System Preferences, or Apple's Software Downloads web site:
http://www.apple.com/support/downloads/
Keywords:
0 comment(s)
×
![modal content]()
Diary Archives
Comments