Что такое вирус blaster
Like us on Facebook
Page tags
Watchers
Follow us on Twitter
| Blaster | |
|---|---|
| Type | Internet worm |
| Creator | |
| Date Discovered | 2003.08.11 |
| Place of Origin | |
| Source Language | C |
| Platform | MS Windows |
| File Type(s) | .exe |
| Infection Length | |
| Reported Costs | $320 Million |
The Blaster worm, also known as Lovesan, created havoc in late summer of 2003 with widespread Distributed Denial of Service (DDoS) attacks, with damage totaling in the hundreds of millions. It is also notable for two hidden text strings, one that says "I just want to say LOVE YOU SAN!" (from which it receives one of its aliases) and a message to Microsoft CEO Bill Gates. It appeared within less than a month before one of the major variants of the Sobig worm.
|
The system will receive code that exploits a DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) from the Blaster worm on an already infected computer coming through TCP port 135. There is an 80% chance that the worm will send exploit code specific to Windows XP an 20% that it will be specific to Windows 2000. If the exploit code does not match the system, the RPC subsystem will fail. On Windows XP and Server 2003, this causes a system reboot. In Windows 2000 and NT 4.0, this causes the system to be unresponsive. After the exploit code is successfully sent to the target machine, the target opens a remote command shell that listens on TCP port 4444. The worm on the infecting computer starts a Trivial File Transfer Protocol (TFTP) server listening on UDP port 69. It sends a command to the target machine over port 4444 to download the worm and run it, then immediately disconnects that port. On the target computer, the command shell is closed and it issues a TFTP "get" command, which downloads the worm from the infecting machine's system folder through port 69 and runs it. After the worm is downloaded, the worm on the infecting computer will close the TFTP server. When run, Blaster adds the value "windows auto update = msblast.exe" to the local machine registry key that causes the worm to run when Windows starts (the registry value may also be msblast.exe). It attempts to create a mutex named BILLY and will abort if it finds one already running, avoiding infection of one computer more than once. It checks the Winsock version, only working on versions 1.0, 1.01, and 2.02. If Blaster finds an active network connection, it will begin looking for new machines to infect. The worm sleeps for 20-second intervals and awakens to look for new machines to infect. Blaster uses two methods of searching for IP addresses to infect new machines. The first method will occur 40% of the time, using the IP address of the infected machine as its base address. The first two numbers of the address are left the same while the fourth value is set to zero and the worm checks the third. If the third number in the IP address is greater than 20, there is a 40% chance that the worm will subtract a random number that is less than 20 and changes its base address to that number. For example, if the infected computer has an IP address of 201.27.173.80, the worm may decide to turn it into 201.27.154.0 if it decides to decrease the third number by 19. The worm will then begin to increment the last number to scan the entire subnet. The second method will occur 60% of the time, selecting a completely random base and incrementing the number from there. The Worm starts a SYN Flood on August 15 against port 80 of windowsupdate.com, creating a distributed DDoS attack against the site after August 16. It may also perform one from the 15th to the last day of every month from January to August and any day from September to December. Blaster cannot spread to the Windows NT or Windows Server 2003, unpatched computers running these operating systems may crash as a result of the worm's attempts to exploit them. However, if the worm is manually placed and executed on a computer running these operating systems, it can run and spread. The Blaster worm shut down CTX, the largest railroad system in the Eastern U.S., for hours, crippled the new Navy/Marine Corps intranet, shut down Air Canada's check-in system and has been implicated in the severety of the Northeast blackout. Maryland Motor Vehicle Administration authority shut its offices for the day because its systems were so severely affected by Blaster that it could no longer continue as normal. Other organisations reportedly suffering network slowdowns or worse because of the worm include German car manufacturer BMW, Swedish telco TeliaSonera, the Federal Reserve Bank of Atlanta and Philadelphia's City Hall. Damage totalled to $320 million. Symantec believes that 188,000 computers were infected with the worm by afternoon of August 13, 2 days after the worm's discovery. Microsoft believes that between 8 to 16 million computers were infected with Blaster. Some systems may have been counted more than once, as the figures were based on the number of submissions of the worm received.
Blaster gets its most-often used name from the file that it drops in the Windows System folder, msblast.exe. Its second name, Lov(e)san comes from the "I LOVE YOU SAN" line in the worm. A few sources also call this worm Poza. Antivirus Aliases
As late as 2005 December, new infections of the worm were still being found with 500 to 800 infections per day. This is mostly because of machines that still have yet to be patched. 79% of infections were on Windows XP Gold, and 21 percent were on Windows XP with Service Pack 1. Infections on machines with Service Pack 2 were non-existent. Sometimes Welchia is listed as a variant of Blaster, usually called Blaster.D, in part thanks to the coherence of different Antivirus companies' naming. In fall of 2006, a German Wikipedia entry for Blaster was edited to contain a link to a site claiming to contain a fix for the worm. The link actually contained malware that infected computers. The cyber-criminals responsible also sent spam emails to German email addresses advising users to visit the Wikipedia page for information on the worm. Since Wikipedia is a legitimate site, it is not filtered by phishing or spam filters. Blaster has had only a few variants of note, and these have not spread far or done much damage. The variants mostly only differ in one or two respects from the original. Blaster.BThe 7,200 byte-long B variant uses the name "penis32.exe" as the worm's file name. Jeffrey Lee Parson was arrested for creating the B variant of the worm. He was convicted and sentenced to 18 months in prison. Blaster.CBlaster.C is 5,360 bytes long. Its file name is "teekids.exe" and adds the value "Microsoft Inet Xp.. = teekids.exe" to the same registry key as the original. Blaster.DThis variant uses the file name "mspatch.exe" and adds the value "Nonton Antivirus = mspatch.exe" to the same registry key as the previous versions. It is 11,776 bytes long. Blaster.EThe E variant of Blaster uses the file name "mslaugh.exe" and adds the value "windows automation = mslaugh.exe" to the same registry key as the original. Blaster.FNu datzi la fuckultatea de Hidrotehnica. Pierdetzi timp ul degeaba… The text translates into "Don't go to the Hydrotechnics faculty. You are wasting your time… Birsan, your pension awaits. I urinate on the diploma. " This variant came from Romania in September of 2003 and was confined to the intranet of a Romanian university. Dan Dumitru Ciobanu, the creator faces 15 years in prison if convicted of "unlawful possession of a program and disturbing a computer system". Blaster.GBlaster.HBlaster.H is a 6,688-byte variant that uses te file name "mschost.exe". It adds "windows shellext.32 = mschost.exe" to the same registry key as the previous versions. Peter Szor. The Art of Computer Virus Research and Defense, "Exploits, Vulnerabilities and Buffer Overflow Attacks", Section 10.4.6, pp. 410-413. eEye Digital Security, ANALYSIS: Blaster Worm. 2003.08.11 Douglas Knowles, Frederic Perriot, Peter Szor. Symantec.com, W32.Blaster.Worm Benjamin Nahorney. Symantec, W32.Blaster.T.Worm. Trend Micro Antivirus, WORM_MSBLAST.A. Amber Maitland. Pocket-lint, Wikipedia infected by malware. 2006.11.06 Часовой пояс: UTC + 3 часа Вирус (червь) Blaster и его братья - мега обсуждение_________________ Вирус W32.Blaster.worm Кому угрожает опасность? Microsoft® Windows NT® 4.0 Как узнать, заражен ли компьютер Действия, которые необходимо предпринять сетевым администраторам 4 действия, которые должны выполнить обычные пользователи 1. Подключите брандмауэр В последних версиях операционных систем Windows имеются встроенные брандмауэры. Пользователи Windows XP и Windows Server 2003 должны напечатать или сохранить приведенные ниже инструкции по подключению брандмауэра и сразу же отключиться от интернета. Выполните указанные инструкции и отключитесь от интернета. Пользователи Windows XP Professional. Выполните эти инструкции, чтобы включить брандмауэр подключения к интернету (EN). ZoneAlarm Pro (EN) (Zone Labs) Если на вашем компьютере уже установлены антивирусные программы, загрузите с веб-узла своего разработчика антивирусных программ последние обновления, также называемые описаниями вирусов. Network Associates (EN) 4. Удалите червя Network Associates (EN) Вот ещё. Кому угрожает опасность? Microsoft® Windows NT® 4.0 Как узнать, заражен ли компьютер Действия, которые необходимо предпринять сетевым администраторам 4 действия, которые должны выполнить обычные пользователи 1. Подключите брандмауэр В последних версиях операционных систем Windows имеются встроенные брандмауэры. Пользователи Windows XP и Windows Server 2003 должны напечатать или сохранить приведенные ниже инструкции по подключению брандмауэра и сразу же отключиться от интернета. Выполните указанные инструкции и отключитесь от интернета. Пользователи Windows XP Professional. Выполните эти инструкции, чтобы включить брандмауэр подключения к интернету (EN). ZoneAlarm Pro (EN) (Zone Labs) Если на вашем компьютере уже установлены антивирусные программы, загрузите с веб-узла своего разработчика антивирусных программ последние обновления, также называемые описаниями вирусов. Network Associates (EN) 4. Удалите червя Network Associates (EN) Внимание! файлик с мсбластом назывался MSLAUGH.EXE! Эта скотина, похоже с собой подхватила и трояна какого-то. _________________ Вирус W32.Blaster.worm Кому угрожает опасность? Microsoft® Windows NT® 4.0 Как узнать, заражен ли компьютер Действия, которые необходимо предпринять сетевым администраторам 4 действия, которые должны выполнить обычные пользователи 1. Подключите брандмауэр В последних версиях операционных систем Windows имеются встроенные брандмауэры. Пользователи Windows XP и Windows Server 2003 должны напечатать или сохранить приведенные ниже инструкции по подключению брандмауэра и сразу же отключиться от интернета. Выполните указанные инструкции и отключитесь от интернета. Пользователи Windows XP Professional. Выполните эти инструкции, чтобы включить брандмауэр подключения к интернету (EN). ZoneAlarm Pro (EN) (Zone Labs) Если на вашем компьютере уже установлены антивирусные программы, загрузите с веб-узла своего разработчика антивирусных программ последние обновления, также называемые описаниями вирусов. Network Associates (EN) 4. Удалите червя Network Associates (EN) _________________ Как сообщает AP, в результате усилий полиции и федеральных служб по борьбе с кибертерроризмом у себя дома, в Миннесоте, в последнюю пятницу августа был арестован 18-летний Джеффри Ли Парсон (Jeffrey Lee Parson), обвиняемый в авторстве нескольких вариаций интернет-червя Blaster. Этот червь нанес ущерб тысячам компьютерных систем по всему миру. Компании, занимающиеся вопросами безопасности, утверждают, что червь Blaster, также называемый MSBlast и LovSan, и некоторые его варианты нанесли ущерб более чем 500000 компьютерам, начиная с 11 августа. Вирус вызывал сбои в большинстве наиболее распространенных версий операционных систем Microsoft Windows. Однако, эти оценки, скорее всего, будут пересмотрены в сторону значительного увеличения, если будет доказано, что Blaster стал одной из причин отключения электроэнергии в США и Канаде 14 августа текущего года. Представители Microsoft заявляют, что ущерб от Blaster и его вариантов оценивается в миллионы долларов. В показатель ущерба, в частности, входят временные затраты персонала технической поддержки, перегрузка сетей, по которым идут жалобы от пользователей, и другие расходы. Однако есть основания полагать, что оценки ущерба придется существенно пересмотреть. По информации Computerweekly.com, червь W32.Blaster мог стать причиной недавнего сбоя в работе электростанции в США 14 августа этого года и привести к масштабному отключению электричества в электросетях Нью-Йорка и Канады. Такого мнения придерживаются представители правительства и специалисты отрасли. Напомним, что именно эта авария стала причиной катастрофического отключения электроэнергии у десятков миллионов человек. Напомним, что системы контроля, упоминаемые Гэри Сейфертом (см. выше), также известны под названием систем мониторинга и контроля данных (Scada) и используются в управлении масштабными производственными процессами, в том числе на российских предприятиях и в отечественной энергоинфраструктуре. Как правило, они работают на базе операционной системы Windows 2000 или Windows XP и используют коммерческие каналы передачи данных, включая интернет и беспроводные системы. Бывший советник администрации Буша, сотрудничавший с департаментом внутренней безопасности США по вопросам энергообеспечения, утверждал, что червь Blaster препятствовал нормальному функционированию электростанций в районе Нью-Йорка. На системах контроля этих станций использовалось программное обеспечение Windows с открытым портом Port 135. Именно через этот порт осуществлялись атаки на системы. Однако, Джо Вейсс (Joe Weiss), специалист по системам контроля и консультант Kema Consulting, утверждает, что причиной недавнего энергетического сбоя стало проникновение червя в коммуникационную инфраструктуру. Ряд экспертов энергетической отрасли, пожелавшие остаться анонимными, заявили, что под угрозой находятся сами системы контроля, напомнив о том, как в январе червь Slammer нарушил процесс осуществления контроля в режиме реального времени на ряде промышленных предприятий. Джеффри Ли Парсон, 18-летний ученик средней школы в Миннеаполисе, обвиняется в нанесении компьютерного ущерба международного масштаба и может быть приговорен максимум к 10 годам лишения свободы и штрафу $250000. В пятницу, 5 сентября, в окружном суде были представлены документальные свидетельства, позволившие выследить автора вируса, в том числе сведения, почерпнутые из баз данных широкого доступа или из опросов интернет-провайдеров. Напомним, что в конце прошлой неделе был задержан другой подозреваемый в распространении модифицированной версии червя Blaster. Это 24-летний Дэн Думитру Цьобану), выпускник Технического университета. Причем червь, по словам специалистов по вирусам компании BitDefender, начал распространяться именно с компьютеров Технического университета. Однако, по словам представителя BitDefender, Цьобану был отпущен из-за отсутствия доказательств. В то же время полицейские уже обратились к специалистам на предмет исследования содержимого компьютеров, изъятых у Цьобану. Возможно, в них будет обнаружен код вируса или другие доказательства причастности к работе над созданием клона вируса интернет-червя Blaster. Таким образом, первые улики против Парсона были обнаружены еще 14 августа, спустя несколько дней после того, как была зафиксирована первая атака червя Blaster. 19 августа ФБР и служба разведки США обыскали дом Парсона и конфисковали 7 компьютеров. Парсон уже заявил следователям, что разработал новую версию вредоносной программы. Он также признался в запуске рассылки инфицированных писем, со вложенным файлом teekids.exe. Именно эти письма позволяли впоследствии получить доступ к зараженному компьютеру. Но, по словам Маккея, пока неизвестно, воспользовался ли Парсон личными или финансовыми данными, которые можно было таким образом получить. This page is rated A, meaning it follows the Manual of Style and has a lot of information. Edit only if there is outdated information, proofreading is required, or if it has to be changed. Blaster
It is also notable for two hidden text strings, one that says "I just want to say LOVE YOU SAN!" (from which it receives one of its aliases) and a message to the Microsoft owner Bill Gates that says "billy gates why do you make this possible ? Stop making money and fix your software!!" It appeared within less than a month before one of the major variants of the Sobig worm. BehaviorThe system will receive code that exploits a DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) from the Blaster worm on an already infected computer coming through TCP port 135. There is an 80% chance that the worm will send exploit code specific to Windows XP an 20% that it will be specific to Windows 2000. If the exploit code does not match the system, the RPC subsystem will fail. On Windows XP and Server 2003, this causes a system reboot. In Windows 2000 and NT 4.0, this causes the system to be unresponsive. After the exploit code is successfully sent to the target machine, the target opens a remote command shell that listens on TCP port 4444. The worm on the infecting computer starts a Trivial File Transfer Protocol (TFTP) server listening on UDP port 69. It sends a command to the target machine over port 4444 to download the worm and run it, then immediately disconnects that port. On the target computer, the command shell is closed and it issues a TFTP "get" command, which downloads the worm from the infecting machine's system folder through port 69 and runs it. After the worm is downloaded, the worm on the infecting computer will close the TFTP server. When run, Blaster adds the value "windows auto update = msblast.exe" to the local machine registry key that causes the worm to run when Windows starts (the registry value may also be msblast.exe I just want to say LOVE YOU SAN!! bill) In other versions of Blaster it would add value mslaugh.exe instead of msblast.exe. It attempts to create a mutex named BILLY and will abort if it finds one already running, avoiding infection of one computer more than once. It checks the Winsock version, only working on versions 1.0, 1.01, and 2.02. If Blaster finds an active network connection, it will begin looking for new machines to infect. The worm sleeps for 20-second intervals and awakens to look for new machines to infect. Blaster uses two methods of searching for IP addresses to infect new machines. The first method will occur 40% of the time, using the IP address of the infected machine as its base address. The first two numbers of the address are left the same while the fourth value is set to zero and the worm checks the third. If the third number in the IP address is greater than 20, there is a 40% chance that the worm will subtract a random number that is less than 20 and changes its base address to that number. For example, if the infected computer has an IP address of 201.27.173.80, the worm may decide to turn it into 201.27.154.0 if it decides to decrease the third number by 19. The worm will then begin to increment the last number to scan the entire subnet. The second method will occur 60% of the time, selecting a completely random base and incrementing the number from there. The Worm starts a SYN Flood on August 15 against port 80 of windowsupdate.com, creating a distributed DDoS attack against the site after August 16. It may also perform one from the 15th to the last day of every month from January to August and any day from September to December. Although Blaster cannot spread to 64-bit Windows or Windows Server 2003, unpatched computers running these operating systems may cause the Remote Procedure Call Service to crash as a result of the worm's attempts to exploit them, causing the system to reboot after 1 minute and some side effects. However, if the worm is manually placed and executed on a computer running these operating systems, it can run and spread. EffectsThe Blaster worm shut down CTX, the largest railroad system in the Eastern U.S., for hours, crippled the new Navy/Marine Corps intranet, shut down Air Canada's check-in system and has been implicated in the severity of the Northeast blackout. Maryland Motor Vehicle Administration authority shut its offices for the day because its systems were so severely affected by Blaster that it could no longer continue as normal. Other organizations reportedly suffering network slowdowns or worse because of the worm include German car manufacturer BMW, Swedish telco TeliaSonera, the Federal Reserve Bank of Atlanta and Philadelphia's City Hall. Damage totaled to $320 million. Symantec believes that 188,000 computers were infected with the worm by the afternoon of August 13, 2 days after the worm's discovery. Microsoft believes that between 8 to 16 million computers were infected with Blaster. Some systems may have been counted more than once, as the figures were based on the number of submissions of the worm received. Blaster gets its most-often used name from the file that it drops in the Windows System folder, msbast.exe. Its second name, Lov(e)san comes from the "I LOVE YOU SAN" line in the worm. A few sources also call this worm Poza. Other FactsAs late as 2005 December, new infections of the worm were still being found with 500 to 800 infections per day. This is mostly because of machines that still have yet to be patched. 79% of infections were on Windows XP Gold, and 21 percent were on Windows XP with Service Pack 1. Infections on machines with Service Pack 2 were non-existent. Sometimes Welchia is listed as a variant of Blaster, usually called Blaster.D, in part thanks to the coherence of different Antivirus companies' naming. In fall of 2006, a German Wikipedia entry for Blaster was edited to contain a link to a site claiming to contain a fix for the worm. The link actually contained malware that infected computers. The cyber-criminals responsible also sent spam emails to German email addresses advising users to visit the Wikipedia page for information on the worm. Since Wikipedia is a legitimate site, it is not filtered by phishing or spam filters. VariantsBlaster has had only a few variants of note, and these have not spread far or done much damage. The variants mostly only differ in one or two respects from the original. The 7,200 byte-long B variant uses the name "penis32.exe" as the worm's file name. Jeffrey Lee Parson was arrested for creating the B variant of the worm. He was convicted and sentenced to 18 months in prison. Blaster.C is 5,360 bytes long. Its file name is "teekids.exe" and adds the value "Microsoft Inet Xp.. = teekids.exe" to the same registry key as the original. Blaster.D is a worm that exploits the DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026 ) using TCP port 135. The worm targets only Windows 2000 and Windows XP computers. While computers that are running Windows NT or Windows 2003 Server are vulnerable to the aforementioned exploit (if not properly patched), the worm is not coded to replicate to those systems. This worm attempts to download the Mspatch.exe file to the %WinDir%\System32 folder, and then execute it. It is 11,776 bytes long. Blaster.E is a worm that exploits the DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026 ) using TCP port 135. The worm targets only Windows 2000 and Windows XP computers. While Windows NT and Windows 2003 Servers are vulnerable to the aforementioned exploit (if not properly patched), the worm is not coded to replicate to those systems. This worm attempts to download the Mslaugh.exe file into the %Windir%\System32 folder, and then execute it. Blaster.F is a worm that exploits the DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026 ) using TCP port 135. The worm targets only Windows 2000 and Windows XP computers. While Windows NT and Windows 2003 Servers are vulnerable to this exploit (if not properly patched), the worm is not coded to replicate to those systems. This worm attempts to download the Enbiei.exe file into the %Windir%\System32 folder, and then execute it. It is 11,808 bytes long. It also contains text in Romanian: Blaster.H is a 6,688-byte variant that uses the file name "mschost.exe". It adds "windows shellext.32 = mschost.exe" to the same registry key as the previous versions. Blaster.K is a worm that exploits the DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026 ) using TCP port 135. The worm targets only Windows 2000 and Windows XP computers. While Windows NT and Windows 2003 servers are vulnerable to the exploit if they are not properly patched, the worm is not coded to replicate to those systems. This worm attempts to download the mschost.exe file into the %Windir%\System32 folder, and then execute it. Blaster.T is a worm that exploits the DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026 ) using TCP port 135. The worm targets only Windows 2000 and Windows XP computers. SourcesPeter Szor. The Art of Computer Virus Research and Defense, "Exploits, Vulnerabilities and Buffer Overflow Attacks", Section 10.4.6, pp. 410–413. eEye Digital Security, ANALYSIS: Blaster Worm. 2003.08.11 Douglas Knowles, Frederic Perriot, Peter Szor. Symantec.com, W32.Blaster.Worm Benjamin Nahorney. Symantec, W32.Blaster.T.Worm. Trend Micro Antivirus, WORM_MSBLAST.A. Amber Maitland. Pocket-lint, Wikipedia infected by malware. 2006.11.06 Читайте также:
 Пожалуйста, не занимайтесь самолечением!При симпотмах заболевания - обратитесь к врачу.
Copyright © Иммунитет и инфекции
|
