RE: Worm attack on our network this morning -- anyone else see this?

["David Gillett" <gillettdavid () fhda edu>]

   I neglected to mention that the "phone home" destinations
are all in the 86.x.x.x range.

Dave


> -----Original Message-----
> From: David Gillett [mailto:gillettdavid () fhda edu] 
> Sent: Wednesday, December 13, 2006 1:05 PM
> To: 'incidents () securityfocus com'
> Subject: Worm attack on our network this morning -- anyone 
> else see this?
>
>   Late Monday afternoon, I noticed that a machine was 
> scanning random addresses across both campuses using port 135 
> (DCE). I blocked the port and tracked the machine to the 
> support area, where one of the techs was reformatting a laptop.
>   Late Tuesday afternoon, I noticed similar traffic from 
> another machine, and blocked that port.
>
>   This morning, that second machine showed up somewhere else 
> on campus, and similar traffic was flooding from 22 
> additional machines, 19 at the big campus and 3 at the other 
> -- most appear to also be laptops.
>
>   In addition to spreading via port 135, I've also seen:
>
> 1. At least one machine eventually started similar scanning 
> on port 445 (CIFS).
>
> 2. These machines all try to "phone home" to port 7654 of a 
> remote machine. I've got that blocked now, but one succeeded 
> and appeared to be talking IRC over that port, reporting a 
> "successful file download" to/from an additional machine 
> which (so far) doesn't appear to have been trying to spread 
> the infection further.
>
>   I've got the "phone home" traffic blocked, and the known 
> infected machines null-routed at the gateway, which *should* 
> make it just about impossible for them to infect outside 
> their own VLANs.
>
>   The targets are all PCs, and most seem to be laptops.  I'm 
> thinking about this week's MS Office 0days, and maybe about 
> recent wireless driver vulnerabilities, but this *could* be 
> something older that walked in on a visiting laptop....
>
> David Gillett


------------------------------------------------------------------------------
This List Sponsored by: Black Hat

Attend the Black Hat Briefings & Training USA, July 29-August 3 in Las Vegas. 
World renowned security experts reveal tomorrow's threats today. Free of 
vendor pitches, the Briefings are designed to be pragmatic regardless of your 
security environment. Featuring 36 hands-on training courses and 10 conference 
tracks, networking opportunities with over 2,500 delegates from 40+ nations. 

http://www.blackhat.com
------------------------------------------------------------------------------