UPDATED: Zotob exploits Microsoft Windows flaw

By Bill Brenner, News Writer 14 Aug 2005 | SearchSecurity.com

Digg This!     StumbleUpon     Del.icio.us

Security experts don't think Zotob will blossom into the next Sasser-sized attack. But they're stunned by how fast a worm was developed to exploit the Plug and Play flaw Microsoft announced less than a week ago. The big worry is that Zotob may be a dress rehearsal for something far worse.

"We're not seeing a large number of reports on Zotob, but I wouldn't be surprized if other malicious code writers jumped on the bandwagon and came up with something bigger," said Graham Cluley, senior technology consultant for Lynnfield, Mass.-based Sophos. "Exploit code was out very quickly after Microsoft released the patch, and now there's a worm."

Finnish security firm F-Secure Corp., the French Security Incident Response Team (FrSIRT) and the Bethesda, Md.-based SANS Internet Storm Center sounded the alarm for Zotob Sunday, warning that it targets the security hole Microsoft outlined in MS05-039, one of the critical bulletins it issued Tuesday as part of its monthly patch rollout. By Monday morning, antivirus firms like Sophos, Cupertino, Calif.-based Symantec and Tokyo-based Trend Micro were issuing alerts as well. At the time of writing, most firms were detecting two variants: Zotob-A and -B.

MS05-039 addressed flaws in Plug and Play, a program that allows users to insert and remove devices like PC cards without having to configure them; connect to or disconnect from a docking station or network without restarting the computer or changing configuration parameters; and add a new monitor or USB keyboard by plugging it in and turning it on. "A remote code execution and local elevation of privilege vulnerability exists in Plug and Play that could allow an attacker… to take complete control of the affected system," Microsoft said Tuesday.

A Microsoft spokesperson said Monday morning that the software giant is monitoring Zotob's progress. She added that Microsoft has posted an advisory on its Web site to help users make sense of the threat.

Zotob's characteristics
Cluley said Zotob-A and -B don't travel by e-mail but spread to other networked machines the way Sasser did -- by exploiting security holes in Microsoft's software.

Once it infects a PC, Zotob opens a backdoor that lets remote hackers gain access and control over the computer, he added. Affected machines then look for other computers to infect.

"Once hackers have control over your computer they can see everything you do online and steal credit card details, your passwords and commit identity fraud if they wish," Cluley said. "These worms are invisible intruders on your Windows PC. They will not announce that they have infected you."

Microsoft said users who have installed the MS05-039 fix have nothing to worry about, and added, "If you are using any supported version of Windows other than Windows 2000, you are not at risk..."

Waiting for the shoe to drop
Security experts have warily watched cyberspace since exploit code for the latest Microsoft flaws began to circulate late last week. The Internet Storm Center took the rare step of raising its alert status to "Infocon Yellow," which means it is tracking a significant new threat. Internet Storm Center handler Tony Carothers said on the organization's Web site Sunday, "Starting around 11:30 UTC, we've received several reports on a new worm variant that makes use of MS05-039 to spread. If you're not patched yet, this is your last call."

Mikko Hypponen, director of AV research for F-Secure

Read more about the Plug and Play flaw and exploits: The Exploits of August   Critical fixes for IE, Windows

, echoed Cluley's comments in the lab's daily blog. "This is nasty, as patches for this vulnerability have only been available for five days," he said. "Patch now."

He said Zotob is based on the prolific Mytob worm and might be using exploit code published four days ago by a researcher who goes by the online name "houseofdabus."

"This whole case has a nasty ring to it," Hypponen said. "The infamous Sasser worm was released two days after houseofdabus released exploit code for the LSASS vulnerability."

Not the next Sasser
That said, Hypponen doesn't expect Zotob to become the next Sasser, which left countless companies around the world reeling from infestations in April 2004.

"First of all, it will not infect Windows XP SP2 machines," Hypponen said. "It also won't infect machines that have 445/TCP blocked at the firewall. As a result, [a] majority of Windows boxes [on] the net won't be hit by it."

Hypponen said his lab also found a message hidden within Zotob: "MSG to avs: the first av who detect this worm will be the first killed in the next 24hours!!!"

The F-Secure Web site has posted a full technical description of Zotob.

Tags: Security Patch Management,  Malware, Viruses, Trojans and Spyware,  Application Attacks (Buffer Overflows, Cross-Site Scripting),  Web Server Threats and Countermeasures,  Web Application and Web 2.0 Threats,  VIEW ALL TAGS

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Security Patch Management Squad: Tokenization, Phishing and the Feds Should management processes change based on a patch release schedule? Should Windows Mobile updates come from Microsoft? Adobe updates ColdFusion, JRun, Flex Trusteer CEO criticizes Adobe, touts better patch deployments Patch management study shows IT taking significant risks Vulnerability mitigation study shows need for faster patching Microsoft to issue security report card, new tool at Black Hat How to manage patches for Adobe When is it suitable to remove Java updates? Malware, Viruses, Trojans and Spyware Schneier-Ranum Face-Off: Is antivirus dead? Modern malware, stealthy botnets, adapt quickly, expert says Computer worm infections up, scareware antivirus down, Microsoft says Web-based attacks skyrocket, pirating sites surge, security firms say Mini guide: How to remove and prevent Trojans, malware and spyware Kaspersky system analyzes malicious URLs on Twitter for malware Silon malware intercepts Internet Explorer sessions, steals credentials Breach forces payroll service provider PayChoice to shut down again RSA research underscores problem tracking cybercriminals Conficker analysis finds P2P coding limited, less sophisticated Application Attacks (Buffer Overflows, Cross-Site Scripting) Adobe warns of critical update for Reader, Acrobat 9.1.3 9 Ways to Improve Application Security After an Incident Developers Need Help with Security Errors Buffer overflow tutorial: How to find vulnerabilities, prevent attacks SQL injection protection: A guide on how to prevent and stop attacks Experts rebuke programmers who use SQL injection as feature SANS: Application threats, website flaws pose biggest security threats Mozilla helps Adobe push out faster patches SSH key compromise shuts down Apache website IBM finds sharp spike in malicious content on trusted sites Application Attacks (Buffer Overflows, Cross-Site Scripting) Research

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary attack vector  (SearchSecurity.com) back door  (SearchSecurity.com) ethical worm  (SearchSecurity.com) Patch Tuesday  (SearchSecurity.com) zero-day exploit  (SearchSecurity.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary