bk99.de entertain the web since 1997

bk99.de
CERT/CC · SecurityCurated

Blaster: the worm that made Windows machines reboot

Summary

On 11 August 2003 the CERT Coordination Center warned about W32/Blaster, a worm that exploited a hole in Windows’ DCOM RPC service via TCP port 135. Windows NT 4.0, 2000, XP and Server 2003 were affected; Microsoft had already closed the hole weeks earlier with MS03-026. Infected computers were to launch a SYN flood against windowsupdate.com, of all things the service that distributed the patch.

How Blaster spread

The worm searched the network for machines with port 135 open, attacked the RPC service and made the victim download a file called msblast.exe from the attacking machine. Without any user action it spread from computer to computer, particularly quickly in networks without a firewall between the clients.

For many users the infection showed itself through crashes of the RPC service, after which Windows rebooted. CERT advised installing the patch, blocking ports 135, 139 and 445 at the network edge and disconnecting infected machines before cleaning them.

Ideas

  • An available patch only protects if it is installed.
  • Network services nobody needs from outside do not belong on the internet.
  • Worms exploit the time between patch and installation.
  • Internal networks without segmentation spread infections further.

Insights

  • Blaster was a turning point for Windows security: with Windows XP Service Pack 2 in 2004 the Windows Firewall was enabled by default, and automatic updates became the norm.
  • The planned attack on windowsupdate.com shows that the attackers deliberately targeted the defence, not just damage.

Facts

  • CERT advisory CA-2003-20 of 11 August 2003.
  • The worm exploited the DCOM RPC hole closed with MS03-026, via TCP port 135.
  • Windows NT 4.0, Windows 2000, Windows XP and Windows Server 2003 were affected.

References

Remarks

  • The advisory survives via the Web Archive.

Recommendations

  • Never expose Windows services such as RPC and SMB directly to the internet.
  • Install patches for wormable holes within days, not in the next maintenance window.
  • Separate clients on your own network where they do not need to talk to each other.

Read the original advisory

Search the Web Archive

CERT/CC · 2000

ILOVEYOU: a love letter brings the world to a halt

On 4 May 2000 the CERT Coordination Center warned about the “Love Letter” worm, which spread as an email with the subject ILOVEYOU and the attachment LOVE-LETTER-FOR-YOU.TXT.VBS. By 8 May more than 650 sites had reported over 500,000 infected computers. The worm exploited no security hole but the curiosity of recipients, hidden file extensions and Outlook’s address books.

g · 2015

Google publishes Windows security hole

In early 2015 Google published a hole in Windows 8.1 after Microsoft had not closed it within 90 days. Via NtApphelpCacheControl, a user with restricted rights could gain administrator rights. Google’s experts had found the vulnerability at the end of September 2014 and informed Microsoft.

hß · 2011

Next Patch Tuesday fixes critical holes in Internet Explorer and Windows Server

For Patch Tuesday on 9 August 2011, Microsoft announced 13 bulletins intended to close 22 holes. Among them were critical holes in all versions of Internet Explorer and in most editions of Windows Server, both exploitable remotely for code execution. Further updates concerned Windows, Office 2003 to 2010, .NET 3.5 and Visual Studio 2005.