Re: Blasting Blaster.Worm (aka LovSan Virus)

It is very well described in the Symantec Alerts we get.

Here is a brief description of how it infects:

1. worm finds host vulnerable to DCOM RPC exploit, attacks on 135/TCP (and UDP... it is safe to assume that traffic will use TCP and/or UDP, so please assume UDP is implied for the rest of my comments)
2. worm causes buffer overflow, yielding a shell on 4444/TCP which intiates outbound tftp to the host it was infected from,downloading msblaster.exe and dropping it on the newly infected host which is rebooted so that msblaster.exe is run on startup
3. msblaster.exe propagates outbound and listens on 69/TCP (which is tftp in case you don't have an /etc/services handy), infecting more hosts and serving out msblaster.exe via tftp

Log/sniff/block 135/TCP, 4444/TCP (which is the port used by krb524, a Kerberos migration service), and 69/TCP.

Regards,

Chris

On Tue, 2003-08-12 at 13:40, Alavan wrote:
> All,
>
> We're a small ISP providing T-1 access to residents of apartment

-- 
iDaemon Security 
Securedaemon.net


---------------------------------------------------------------------------
----------------------------------------------------------------------------