News
Bot the Likely Culprit for WINS Flaw Activity
There was a flurry of discussion regarding a possible WINS
worm due to a spike in WINS port 42 traffic.
The vulnerability arises from a problem with the Microsoft Windows Internet Naming Service. Microsoft posted a patch on Dec. 14 for the flaw, which was unusual in that it was already public. Most Microsoft patches serve as the first indication outside of Microsoft and a single security firm or researcher that the patched flaws exist.
Since the vulnerability is only found in WINS servers, not WINS clients, and since WINS servers are few and far between, we quickly surmised that one or more of the current bots had included the recently published exploit and started scanning for it.
Anyone with such a bot already installed would then emit the
attack packets.
A bot is any piece of software which makes a victim system behave like a robot. Once the software is executed, it causes the system to take instructions from the bot owner.
This is typically done via an IRC channel. The bot, when started, registers itself to the bot owner as part of that person's botHerd. A botHerd is simply the name given to a group of similar bots under the control of a single owner, or group of owners.
By establishing an outbound connection to the bot IRC channel,
bots can bypass many firewalls or similar controls where outbound
traffic is, unfortunately, typically allowed.
Bots are notorious for quickly implementing new vulnerability exploit code, and since the botHerd owners have an established base of
attacking systems, the attack can easily look like a worm.
An instruction is issued in the controlling IRC channel and the bots
dutifully update themselves with whatever new attacks the bot owner has
coded. Then they'll typically resume their activities, be it spamming,
attacking or whatever the owner desires.
Russ Cooper is a Senior Information Security Analyst with
Cybertrust, Inc., www.cybertrust.com. He's also founder and editor of
NTBugtraq, www.ntbugtraq.com, one of the industry's most influential
mailing lists dedicated to Microsoft security. One of the world's most-
recognized security experts, he's often quoted by major media outlets
on security issues.
Russ Cooper's Security Watch column appears every Monday in the
Redmond magazine/ENT Security Watch e-mail newsletter. Click here to
subscribe.
About the Author
Russ Cooper is a senior information security analyst with Verizon Business, Inc.
He's also founder and editor of NTBugtraq, www.ntbugtraq.com,
one of the industry's most influential mailing lists dedicated to Microsoft security.
One of the world's most-recognized security experts, he's often quoted by major
media outlets on security issues.