SANS Internet Storm Center, Symantec, McAfee Warn of Renewed Windows 'MS06-040' Attacks
A network-aware worm dubbed 'Randex.gel,' opens a back door on any compromised computer, then tells the system to listen for additional commands over an Internet Rely Chat (IRC) channel. "It looks like it's a derivative of other Randex variants," said Oliver Friedrichs, director of Symantec's security response group. "But it's added the MS06-040 vulnerability."
Both Symantec and the SANS Institute's Internet Storm Center alerted users that they had detected a significant increase worldwide in activity on port 139, one of the two ports, which an exploit against the MS06-040 vulnerability would use to attack systems.
The Internet Storm Center (ISC) spotted a major spike in port 139 activity starting Sunday, Aug. 27, while Symantec's sensor network recorded large increases on both Tuesday, Aug. 29 and Wednesday, Aug. 30. According to Symantec, the systems attacking port 139 were also involved in attacks on port 445, the other likely route attackers exploiting the Server service would use.
"There could be several possibilities for this," said Lorna Hutcheson, an analyst with the ISC, in an online note. But she discounted earlier bots that had circulated soon after MS06-040 was released. "Both were [recognized] on August 14, so they have been around for a whileand this upswing just started over the past couple of days," Hutcheson wrote. Generally, a jump in activity against one or more of Windows' ports means that attackers are scanning the Internet for vulnerable systems. Symantec's analysis was more specific in pegging possible causes for the uptick in port 139 activity.
"A new variant of Spybot named W32.Spybot.AKNO has been discovered propagating in the wild," Symantec said in a warning issued early Thursday to users of its DeepSight threat management service. The bot designed to infiltrate a system, then download additional malicious code to hijack the computer so it can be used as a Spam zombie or for other criminal activities also contains a rootkit component, Symantec added. A rootkit is code that cloaks a worm or bot to make it harder for anti-virus software to both detect and delete the malware.
"That Spybot picked this up [an MS06-040 exploit] isn't surprising," said David Cole, the director of Symantec's security response team. "Spybot is one of the most prevalent bots out there. What is interesting is that it also threw in rootkit capabilities."
"At this time the attack does not appear to be self replicating and only impacts computers running Windows 2000 who have not applied the MS06-040 security update," a Microsoft spokesman said, adding that the company considers the malware a low-level threat because it is not aware of any widespread customer impact. Nevertheless, he said, "The Microsoft Security Response Center remains on high alert and continues to recommend that customers apply the August security updates."
