TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ----------------------------------------------------------------------------
User_Defined Signature with Email_Sender and a regular expression. Something in the style of "bgnd2@canada\.com|cxkawog@krovatka\.net" Where the pipe | stands for OR. -----Original Message----- From: Wangler, Dan [mailto:[EMAIL PROTECTED]] Sent: donderdag 29 november 2001 17:39 To: ISS XForce; [EMAIL PROTECTED] Subject: RE: ISS Security Brief: Badtrans Class of Worms TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ---------------------------------------------------------------------------- Thanks you for the string to capture incoming Badtran email. I had set up one to trap on .scr and .pif but they were producing mostly false positives. I am also interested in the list that Badtrans mails to (quoting from the Security Brief): [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] But you do not say how to generate a user defined signature to trap on all of these. I could generate 17 individual signatures but surely there is a way to set up a single trap on "[EMAIL PROTECTED]" or "[EMAIL PROTECTED]" or ... Thanks Dan Wangler, GIAC Certified Intrusion Analyst IT Security Response Team, Texas Instruments, Inc. Spring Creek Bldg 1, C196, 6500 Chase Oaks, Blvd, MS 8417, Plano, Texas, 75023 Tel #; 214-567-8304; Email:; [EMAIL PROTECTED] -----Original Message----- From: X-Force [mailto:[EMAIL PROTECTED]] Sent: Wednesday, November 28, 2001 9:16 PM To: [EMAIL PROTECTED] Subject: ISS Security Brief: Badtrans Class of Worms TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ---------------------------------------------------------------------------- -----BEGIN PGP SIGNED MESSAGE----- ISS X-Force Security Brief November 28, 2001 Badtrans Class of Worms Badtrans is a mass-emailer worm that includes some enhanced functionality to record an infected user's keystrokes. Badtrans is not intentionally destructive to files or data, but it may cause network traffic difficulties if an infection is serious. The Badtrans worms contain three main components: - - Microsoft Malformed MIME header exploit - - MAPI mass emailing engine - - Keystroke logging functionality Microsoft Malformed MIME header exploit Badtrans exploits the Malformed MIME header vulnerability to force execution of the Trojan attachment, even if the user does not open the email message. The Nimda class of worms also uses this vulnerability to increase its effectiveness and its rate of propagation. For more information on this vulnerability, refer to the Microsoft Security Bulletin MS01-020: http://www.microsoft.com/technet/security/bulletin/MS01-020.asp. MAPI mass emailing engine MAPI (Messaging Application Programming Interface) is the interface used by Microsoft Exchange and Microsoft Outlook to manage email, contacts, and other data on the host or on the network. Many email worms use MAPI calls to gather email addresses and send emails. Badtrans reads the infected user's address book using the MAPI interface, and then sends a copy of itself to each contact in the list. This functionality is the same that is found in many other email worms. Keystroke logging functionality The author of Badtrans used a modified version of the "Hooker" keystroke logging software. Hooker was designed to gather information on the host by looking for passwords, gathering IP addresses, and capturing keystrokes. Badtrans configured Hooker to send this information to one of several email addresses. The current implementation logs the captured information into the file "CP_25389.NLS". Removal Instructions: 1. Delete the CP_25389.NLS file from the C:\Windows\System or C:\Winnt\System32 directory (depending on your configuration). 2. Using regedit, locate the HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce registry key. 3. Delete the "kernel32" value. 4. Restart your system. Additional Information: ISS X-Force Database, http://xforce.iss.net/static/7607.php Recommendations: Security administrators should update perimeter and desktop anti-virus software with the latest signature files. Refer to Microsoft Security Bulletin MS01-020 at the following address for patch information regarding the Malformed MIME header vulnerability: http://www.microsoft.com/technet/security/bulletin/MS01-020.asp Upgrade or patch vulnerable Internet Explorer versions immediately. Internet Scanner: Internet Scanner provided support for the Malformed MIME header vulnerability detailed in Microsoft Security Bulletin MS01-020 in XPU 5.1. Internet Scanner can check for this vulnerability. Finding and patching this vulnerability can slow or stop propagation of any worm or malicious code that attempts to automatically open hostile attachments. Please note that this check requires administrative access on scanned hosts. RealSecure Network Sensor: Customers may create a user-defined event to detect incoming copies of Badtrans in email by implementing an Email_Content event using the string (including quotes): "====_ABC1234567890DEF_====" Follow the instructions below to apply the user-defined signature to your policy. 1. Choose a policy you want to use, and click 'Customize'. 2. Select the 'User Defined Events' tab. 3. Click 'Add' on the right-hand side of the dialog box. 4. Create a User Defined Event. 5. Type in a name of the event. 6. In the 'Context' field for each event, select 'Email_Content'. In the 'String' field, type the following string (with quotes): "====_ABC1234567890DEF_====" 7. Save your changes, and close the window. 8. Click 'Apply to Sensor'. Customers may also create user-defined events to detect outgoing email transmissions from computers infected with Badtrans. Badtrans sends captured information in email messages to the following addresses: [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] ISS has the following services for preventing worms or assisting you in case of a worm infection: - - Penetration Testing for pro-actively identifying potential worm-infection areas. - - Emergency Response Services for providing an incident response plan for containing and eliminating the worm. - - Remotely Managed AntiVirus Gateway where ISS automatically updates and protects against viruses and worms at the gateway. - - Remotely Managed IDS where ISS can monitor and respond to worm attacks. - - Remotely Managed Scanner where ISS can pro-actively identify vulnerabilities that would allow a worm into the network and provide best practice guides for addressing these weaknesses. ______ About Internet Security Systems (ISS) Internet Security Systems is a leading global provider of security management solutions for the Internet, protecting digital assets and ensuring safe and uninterrupted e-business. With its industry-leading intrusion detection and vulnerability assessment, remote managed security services, and strategic consulting and education offerings, ISS is a trusted security provider to more than 8,000 customers worldwide including 21 of the 25 largest U.S. commercial banks and the top 10 U.S. telecommunications companies. Founded in 1994, ISS is headquartered in Atlanta, GA, with additional offices throughout North America and international operations in Asia, Australia, Europe, Latin America and the Middle East. For more information, visit the Internet Security Systems web site at www.iss.net or call 888-901-7477. Copyright (c) 2001 Internet Security Systems, Inc. All rights reserved worldwide. Permission is hereby granted for the redistribution of this Alert electronically. It is not to be edited in any way without express consent of the X-Force. If you wish to reprint the whole or any part of this Alert in any other medium excluding electronic medium, please e-mail [EMAIL PROTECTED] for permission. Disclaimer The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties with regard to this information. In no event shall the author be liable for any damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk. X-Force PGP Key available at: http://xforce.iss.net/sensitive.php as well as on MIT's PGP key server and PGP.com's key server. Please send suggestions, updates, and comments to: X-Force [EMAIL PROTECTED] of Internet Security Systems, Inc. -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: noconv iQCVAwUBPAWnszRfJiV99eG9AQG9+AP+Lz3OksFrT9Zd1zfVFduovqHiM3rxAg+h +8dftT4n/I5dEI0Vj6sdxPCwubgYYm31Iv++OtJbiJhCgRhMuDT2DkVc7RD+/e8C Y70oBY+wO6c1VEciXHfObobzcOTZqTQ30WtD5uiG+bTCzlswO/hLIErMggkdtp29 k4baL8eLxdA= =pmHx -----END PGP SIGNATURE-----
