Conficker malware ups the ante

Roger A. Grimes explains why keeping up to date with patches can mean the difference between a functional system and a playground for hackers

TAGS: Hacks and breaches, Internet Security, Risk Management

I'm finding many Windows servers without the MS08-067 patch and no specific mitigations applied. There hasn't been a very large malware outbreak (a la Code Red, SQL Slammer, etc.) in a few years, and perhaps this could be leading to a false sense of security.

If you don't patch, the ever-transforming Conficker malware program could end up testing your security perimeter breach responses. Microsoft released the patch on Oct. 23, 2008, nearly two months ago. To remain unpatched at this point and time doesn't seem to be a great idea, but there are still plenty of vulnerable servers out there.

How the Conficker worm still wreaks havoc

The Conficker worm's main exploit vector is by buffer overflowing unpatched versions of Windows Server services, which is represented by the Workstation and Server services, and svchost.exe processes. Initial exploitation normally occurs remotely over NetBIOS/SMB ports 139 or 445 using a malformed RPC request. It can be accomplished with an unauthenticated connection in Windows XP Pro and Windows Server 2003, but requires an authenticated connection in Windows Vista and Windows Server 2008.

[ Take a slideshow tour of InfoWorld's 2009 Technology of the Year Award winners in Applications, Middleware, and Data Management | Application Development | Platforms and Virtualization | Systems and Storage |Networking and Security ]

Once a system is infected, Conficker takes a variety of actions, including exploiting several routes that have nothing to do with the Server services. It disables common anti-malware programs and uses DNS modifications to prevent local end-users from surfing to anti-malware-related Web sites (which might be one of the first clues that you're infected). It spreads to mapped file shares and identified removal drives. Once there, it creates a subdirectory folder called Recycler (emulating the Recycle Bin) and places an Autorun.inf file, which may be auto-launched when visited.

It attempts to connect to remote admin drive mappings using hundreds of common, weak passwords, including multiple versions of numbers and letters. If you find an infection on your network, you probably want to check out the list and see if any of your passwords are located there. Using either exploit vector, Conficker is able to infect computers that are fully patched after first exploiting one unpatched network computer. Conficker isn't the first worm to do any of these things, but the most popular worms rarely do anything new.

How admins are protecting servers from Conficker -- or not

I don't understand why more administrators aren't patching Windows servers. Maybe they think the perimeter firewall will protect them, since they don't allow ports 139 or 445 access from the Internet. But as anyone from the MS-Blaster days can tell you, a perimeter firewall really doesn't provide that much protection in today's world of traveling laptops and remote VPN users.

I'm sure some of the problem is due to the distrust of Microsoft patches. In the past, some Microsoft patches have caused operational issues. Although Microsoft is getting a lot better on this, it's hard to forget if you've been burned in the past. That's understandable, and why any patch management strategy should have acceptable regression testing built into it.

Some of my clients don't have identical test environments to test patches on. That's understandable, although setting up VM environments should make the task easier cost-wise. Many of the biggest VM vendors, certainly VMware and Microsoft, offer free utilities that will snapshot a real, physical box into a test VM image. But even if you have an identical VM, unless it is being thoroughly tested as if it were functional on the production network, it's never a completely thorough test.

Patching best practices

So always have a plan for reversing patches once applied on the production network. Servers should have a complete backup prior to any patch being applied. Microsoft offers free technical support (866-PCSAFETY) for any security update-related issue. For mission-critical servers, consider using clustering or network load-balancing services to allow one server at a time to be patched, instead of trying to patch all at once.

If you don't want to (or can't) apply the patches in a timely manner, implement suggested workarounds and mitigations. Microsoft offers these in every security bulletin. If your environment is so thin on assets and resources that you simply cannot take the time to regression test before applying patches, back up the servers and apply the patches. Today's Internet is too malicious to let unpatched servers hang around on your network. The patches are being code-reversed in minutes and the worms are pouring out into the public in hours.

I do a lot of on-site security reviews. Frequently I'm told that all patches are being applied in a timely manner, but when I audit sample servers, I find out that isn't really the case. If you're an IT manager, do a little spot checking to see if necessary patches are being applied. Use your regular patch management auditing tool or simply use Microsoft's free Baseline Security Analyzer (MBSA).

Many organizations cannot patch quicker than a few weeks because of security policy or oversight boards. If this is the issue, take your case to management and ask that a more timely response be allowed for high-risk scenarios. Your patching strategy must be updated for the times. Waiting weeks to patch servers is no longer a best practice. It's an outlier, and if anyone is ever asked in court to defend how they supported something, the lawyers and the court system always rely on best practices and due diligence as the baseline defense. Make sure you're not the one having to explain why you deviated from best practices in patch management.

Fighting malware: An interview with Paul Ferguson

Paul Ferguson has been fighting malware since the days of the earliest attacks. In this InfoWorld interview, Roger Grimes talks with his longtime colleague about the state of current threats and what they future of malware may hold

TAGS: Hacks and breaches, Internet Security, Security Culture

I first started fighting computer malware back in 1987. Back then, it was a lot easier. We didn't have the Internet (in widespread use). Viruses and Trojans were limited to an even dozen on the PC DOS platform, with four times that on the Mac and other nubile personal computer platforms. I read Ross Greenberg's book on Flushot over and over and talked to many anti-virus leaders and coders, including John McAfee, on a fairly regular basis. We even had an early version of the Internet using BBSes (bulletin board systems) and store-and-forward e-mail lists on the FIDONet. We couldn't believe how our e-mails went around the world -- in less than a day! It was pretty heady stuff.

I learned assembly language from Peter Norton's programming guides to learn how to disassemble viruses, which were sent to me to analyze and write up. I was 19, sopping up knowledge like a new sponge, and looking for a place where I could learn more. That place ended being the PC Antivirus Research Foundation. One of its leaders, Paul Ferguson, seemed piped into an inside channel. He never seemed to sleep -- the type of guy who always responded to a 3 a.m. e-mail so fast that you knew he was awake, too. He got the viruses from around the world first and assigned nightly disassembly duties. We worked together for many years until the rush of viruses (now coming in at dozens per week instead of one or two a day) overwhelmed our serious hobby. But I never forgot how he took me under his wing and challenged me to do better. A decade later, I dedicated one of my first books on computer security to him.

Imagine my surprise when I ran into him on a private anti-malware mailing list this year. The other members rallied to defeat my nomination for group membership because I was a journalist and the group's discussions should never be discussed publicly. Paul Ferguson vouched for me. Since then, I've been privy to a very active group of anti-malware fighters, made up of law enforcement, ISPs, researchers, and anti-malware companies. When something malicious is pushed to the Internet, the reports, samples, and full details are available within the hour. I've found my FIDONet again. Paul has been a fixture in the malware the whole time, and I decided to conduct a short interview.

IW: Paul do you still work all those hours?

Paul: Yes, I still probably work 80-100 hours a week.

IW: Are you married or do you have kids?

Paul: Last child is in college, so now all I have are the dogs.

IW: Paul, what is your official title these days?

Paul: I'm a senior threat researcher for TrendMicro. After our early anti-virus days, I went big into networking. I worked for Cisco, flying around the world. I filled up two passports working with large telecoms on large-scale routing. But no matter what my day job was, my heart was always in anti-malware, so I've been back full-time in the industry for a while.

IW: What is your primary job?

Paul: I do a lot of work in malware data collaboration, tracking and linking historical data points for anti-malware analysis, but my primary goal is cybercrime investigations. I like trying to find the bastards behind this stuff and throw them into jail. Some people call them virus writers or miscreants. I call them what they are -- criminals!

IW: Explain a bit more about the data collaboration.

Paul: The sheer volume of malware is incredible. The real challenges is in collecting the data from as many points as you can and putting together facts in such a way that law enforcement sees them immediately as usable evidence. The better job we can do collecting and normalizing the data up front, the easier it is to help law enforcement to get subpoenas and arrest warrants.

IW: Is the malware world made up a few large organizations, like the Russian Business Network (RBN) and Rockphish, or is it every man for himself?

Paul: It's both, and it depends on the motivation. In Russia, Ukraine, and Eastern Europe, it's run by a few large organizations, even if they are pretending to be many small groups. That's part of my job. By correlating the data, we can identify the players by their data fingerprints. They tend to stick to a few tried and true techniques. Their bots and worms are similar. What they do is similar. They often come from the same IP addresses and hosts and use the same DNS services.

But even the big groups have a bunch of freelance, low-level operators answering ads for specific skill sets, doing the coding, collecting their money, and then going on their way to the next big group. I've tracked them down to who they really are -- I know their names, what they look like, where they live -- but they aren't the guys who are really pulling the strings.

IW: Do you know any of the big guys' names?

Paul: Not really. We have lots of strong, reliable information, but not what I consider factual information we can present to law enforcement. The problem is that many of these guys, like Flyman, the code name for the leader of the Russian Business Network, uses the policy holes in the system to operate out in the open. They operate freely in Russia, and we aren't going to touch him there. But worse than that, they [large cybercrime organizations] are working out in the open here, in the United States. They have co-located computers and lots of bandwidth.

IW: What about China?

Paul: That's a good question. Chinese hackers aren't doing the same thing as the Eastern Europeans and Russia. China is composed of hundreds of thousands of small hacking groups. They aren't pushing huge botnets, bank-stealing Trojans, and child pornography like the other guys. China is more hackivist, more of a social thing. Sure, there are some professional criminal groups involved with corporate espionage and certainly some state sponsored hacking against other governments, but it isn't the same thing. Of course with China you have to be worried about the fake Cisco routers and things like that. But a lot of the criminal hacking that comes out of China isn't done by the Chinese. It's done by other countries, like Russia. That's part of the value that we're seeing from the digital fingerprints I was talking about before. China has millions of unpatched PCs, and the world takes advantage of that to set up base and to attack other countries with impunity.

IW: What are you trying to do to defeat cybercrime?

Paul: I'm continuing the work on building huge anti-malware data correlation systems. Correlating historical data points with IP addresses and domain names, and building relationships with law enforcement, ISPs, registars, everyone possible. I'm on five private operational lists for real-time information trying to make sure the right people are in the loop. Malware isn't going away. It's too profitable, and there isn't a single magic solution. There is no single hammer. Even if we perfect international law enforcement of cybercrime, it won't stop it. Even if the ICANN brings the registars under control it won't stop it. No single entity can do it alone. It will take us all, working together in concert, to stop malware. We are all stakeholders, and we all need to come together. I'm working hard to do my part.

IW: That's the Paul I've always known. Continue fighting the good fight!