RE: Worm on 445/tcp?

["OBrien, Brennan" <BOBrien () columbia com>]

Apparently this has been identified as WORM_LIOTEN.A through TREND,
W32.HLLW.Lioten via Symantec and W32/Lioten.worm via McAfee.  

Update dats and close open shares.  (Like anyone here doesn't know to do
that already... :) 

Happy Holidays all. 

Brennan


-----Original Message-----
From: Scott A.McIntyre [mailto:scott () xs4all net] 
Sent: Monday, December 16, 2002 11:56 PM
To: incidents () securityfocus com
Subject: Worm on 445/tcp?

Over the past two weeks or so I've been noticing a steady rise in what 
appears to be worm related traffic to the new unified smb over tcp port 
(445) on Microsoft Win2k and newer operating systems.

I haven't yet been able to properly identify what the culprit is; at 
first I thought a variation of OpaServ, and that hasn't been fully 
ruled out, but I'm not quite convinced of that either.  Anyone have any 
clues that might help pin this down further?

An infected machine seems to send the following:

1095 114.002629 src -> dst  SMB Negotiate Protocol Request
1105 114.363458 src -> dst  SMB Session Setup AndX Request
1106 114.774364 src -> dst  SMB Session Setup AndX Request
1107 115.168792 src -> dst  SMB Tree Connect AndX Request,Path: 
\\dst\IPC$
1110 115.330792 src -> dst  SMB NT Create AndX Request, Path: \samr
1112 115.652261 src -> dst  DCERPC Bind: call_id: 1 UUID: SAMR
1136 117.759036 src -> dst  SAMR Connect4 request
1137 118.299350 src -> dst  SMB Close Request, FID: 0x4000
1142 119.004483 src -> dst  SMB Logoff AndX Request
1150 119.375665 src -> dst  SMB Tree Disconnect Request

And another:

7.933416 src -> dst SMB Negotiate Protocol Request
10.958481 src -> dst SMB Session Setup AndX Request
13.654558 src -> dst SMB Tree Connect AndX Request, Path: \\dst\IPC$
13.926353 src -> dst SMB NT Create AndX Request, Path: \samr
15.231252 src -> dst DCERPC Bind: call_id: 1 UUID: SAMR
17.149345 src -> dst SAMR Connect4 request
20.405997 src -> dst SAMR EnumDomains request
23.579240 src -> dst SAMR LookupDomain request
25.341903 src -> dst SAMR OpenDomain request
25.891947 src -> dst SAMR EnumDomainUsers request
26.597393 src -> dst SAMR Close request
29.615040 src -> dst SMB Close Request, FID: 0x4000
30.048894 src -> dst SMB Logoff AndX Request
32.738878 src -> dst SMB Tree Disconnect Request


It appears as though there's a high degree of randomness to the 
destination IP addresses that are chosen by the worm as can be seen 
from this 1 second snapshot:


     121.33.1.48
   91.71.109.105
    76.123.46.27
   222.120.99.35
    124.72.254.8
   17.64.153.118
    27.23.33.121
   185.33.178.38
   151.49.213.31
   167.60.15.125
   132.86.243.68
   26.125.133.71
    1.104.130.21
    40.88.91.120
   48.101.140.21
     48.93.34.36
   193.60.220.48
    117.26.58.96
     27.2.15.114
     25.7.221.31


Note: the infected system's ip address is not within any of these 
network segments.

I've noticed others reporting similar increase in traffic, but so far 
haven't seen a definitive acknowledgment of precisely what it is that's 
responsible.

Any pointers gratefully accepted.




------------------------------------------------------------------------
----
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com