On July 16th, 2003, a patch was released for
an
RPC Vulnerability in Windows. Exploit code for the vulnerability was
released less than a week later. This vulnerability operates via TCP
135 and other ports, and will allow a machine to be compromised by a remote
attacker. The patch for this vulnerability can be found at
Microsoft's security site. (It was also distributed via
Windows Update).
At least one trojan and one worm which exploit this
vulnerability have already been found in wild. Since the afternoon of
August
11th, 2003, the number of attacks has increased significantly. One of the
exploit vehicles, the
Blaster Worm, victimizes systems by remotely shutting them down. If your system is
exploited, you will see
something similar to the following:
If you are
in receipt of this message, then it means three very important things:
1. Your firewall, if installed, is not properly
configured.
2. You have not installed the patch for this vulnerability.
3. Your AntiVirus software is not up to date.
Please correct these deficiencies at your earliest
convenience. Symantec has provided a
removal tool that you should run before attempting to patch your
systems -- especially if they were infected. Other Anti-Virus vendors
have also provided stand-alone tools to identify infected machines, and
remove any related trojans.
Also, contrary to popular opinion, being on dial-up will not
protect you. ANY Internet connection, no matter how slow, is deadly
to an unpatched system, and machines have been infected in as little as
30 seconds after going online. As of January 2004, there are still
millions of unpatched systems out there, and you never know when one or more
of them is scanning systems in your subnet.
If you are using Windows XP, you can configure the
built-in ICF firewall which will allow your system to remain up long enough
to get this, and other, security patches installed. You should also
kill the MSBLAST.EXE process as soon as possible, using the following
command:
TASKKILL /F /IM MSBLAST.EXE
XP users can abort the shutdown process with the following
command:
SHUTDOWN /A
It is highly advisable that you prep these commands in a
CMD window to make them easier to execute.
After installing
the patch, be sure to update your antivirus software and scan your machine
to make sure that the worm is not resident on your systems.
Keep the Internet Safe: Please Patch
Your Systems!!
