Sudden spate of Messenger "security alerts"
"J.D. Baldwin" <[email protected]>
| Newsgroups | gmane.comp.security.intrusions |
|---|---|
| Message-ID | <[email protected]> |
I don't think this attack is at all new, but I haven't seen more than
a few of these a day in a long, long time. I suddenly started getting
a whole lot of attempts to open "security alert" Messenger dialog
boxes on a windows host (successfully stopped by a firewall).
Timestamps in the tcpdump output are UTC-4.
Anyway, as of 1148 EDT Sunday morning, Aug. 29th, I started seeing 4-5
of these per hour, representing more than an order of magnitude
increase over the historical levels at my net. I'm just curious
whether anyone else saw a sudden surge in this activity today.
Here are two examples. The others are more of the same.
11:48:24.516517 I 195.194.36.237.16600 > xxx.yyy.1.2.1026: udp 808
0000 04002800 10000000 00000000 00000000 ..(.............
0010 00000000 00000000 f8917b5a 00ffd011 ..........{Z....
0020 a9b200c0 4fb6e6fc 92b40e58 e4c1d5cf ....O......X....
0030 6749ab01 8bddbd15 00000000 01000000 gI..............
0040 00000000 0000ffff ffffd802 00000000 ................
0050 13000000 00000000 13000000 4d494352 ............MICR
0060 4f534f46 54204e45 54574f52 4b530000 OSOFT NETWORKS..
0070 13000000 00000000 13000000 57494e44 ............WIND
0080 4f575320 55534552 00000000 8c020000 OWS USER........
0090 8c020000 00000000 8c020000 4d696372 ............Micr
00a0 6f736f66 74205365 63757269 74792042 osoft Security B
00b0 756c6c65 74696e20 4d533033 2d303433 ulletin MS03-043
00c0 0d0a0d0a 42756666 6572204f 76657272 ....Buffer Overr
00d0 756e2069 6e204d65 7373656e 67657220 un in Messenger
00e0 53657276 69636520 436f756c 6420416c Service Could Al
00f0 6c6f7720 436f6465 20457865 63757469 low Code Executi
0100 6f6e2028 38323830 3335290d 0a0d0a41 on (828035)....A
0110 66666563 74656420 536f6674 77617265 ffected Software
0120 3a200d0a 0d0a4d69 63726f73 6f667420 : ....Microsoft
0130 57696e64 6f777320 4e542057 6f726b73 Windows NT Works
0140 74617469 6f6e200d 0a4d6963 726f736f tation ..Microso
0150 66742057 696e646f 7773204e 54205365 ft Windows NT Se
0160 72766572 20342e30 200d0a4d 6963726f rver 4.0 ..Micro
0170 736f6674 2057696e 646f7773 20323030 soft Windows 200
0180 30202020 0d0a4d69 63726f73 6f667420 0 ..Microsoft
0190 57696e64 6f777320 58502020 0d0a4d69 Windows XP ..Mi
01a0 63726f73 6f667420 57696e64 6f777320 crosoft Windows
01b0 57696e39 38202020 0d0a4d69 63726f73 Win98 ..Micros
01c0 6f667420 57696e64 6f770000 c9fa3141 oft Window....1A
01d0 84f50200 f4010000 52030000 16000200 ........R.......
01e0 000000a0 8e2046ff 000500e5 d74a0800 ..... F......J..
01f0 45000344 dc510000 7611ca3b c34c41a2 E..D.Q..v..;.LA.
0200 xxxxxxxx 59340403 03300000 04002800 .........0....(.
0210 10000000 00000000 00000000 00000000 ................
0220 00000000 f8917b5a 00ffd011 a9b200c0 ......{Z........
0230 4fb6e6fc b43c0f22 87127aa4 bf6015fb O....<."..z..`..
0240 93dc7664 00000000 01000000 00000000 ..vd............
0250 0000ffff ffffd802 00000000 13000000 ................
0260 00000000 13000000 4d494352 4f534f46 ........MICROSOF
0270 54204e45 54574f52 4b530000 13000000 T NETWORKS......
0280 00000000 13000000 57494e44 4f575320 ........WINDOWS
0290 55534552 55534552 00000000 8c020000 USERUSER........
02a0 00000000 8c020000 4d696372 6f736f66 ........Microsof
02b0 74205365 63757269 74792042 756c6c65 t Security Bulle
02c0 74696e20 4d533033 2d303433 0d0a0d0a tin MS03-043....
02d0 42756666 6572204f 76657272 756e2069 Buffer Overrun i
02e0 6e204d65 7373656e 67657220 53657276 n Messenger Serv
02f0 69636520 436f756c 6420416c 6c6f7720 ice Could Allow
0300 436f6465 20457865 63757469 6f6e2028 Code Execution (
0310 38323830 3335290d 0a0d0a41 66666563 828035)....Affec
0320 74656420 536f6674 ted Soft
(ttl 118, id 15439)
4500 0344 3c4f 0000 7611 867d c3c2 24ed
xxxx xxxx 40d8 0402 0330 0000 0400 2800
1000 0000 0000 0000 0000 0000 0000 0000
0000 0000 f891 7b5a 00ff d011 a9b2 00c0
4fb6 e6fc 92b4 0e58 e4c1 d5cf 6749 ab01
8bdd bd15 0000 0000 0100 0000 0000 0000
0000 ffff ffff d802 0000 0000 1300 0000
0000 0000 1300 0000 4d49 4352 4f53 4f46
5420 4e45 5457 4f52 4b53 0000 1300 0000
0000 0000 1300 0000 5749 4e44 4f57 5320
5553 4552 0000 0000 8c02 0000 8c02 0000
0000 0000 8c02 0000 4d69 6372 6f73 6f66
7420 5365 6375 7269 7479 2042 756c 6c65
7469 6e20 4d53 3033 2d30 3433 0d0a 0d0a
4275 6666 6572 204f 7665 7272 756e 2069
6e20 4d65 7373 656e 6765 7220 5365 7276
6963 6520 436f 756c 6420 416c 6c6f 7720
436f 6465 2045 7865 6375 7469 6f6e 2028
3832 3830 3335 290d 0a0d 0a41 6666 6563
7465 6420 536f 6674 7761 7265 3a20 0d0a
0d0a 4d69 6372 6f73 6f66 7420 5769 6e64
6f77 7320 4e54 2057 6f72 6b73 7461 7469
6f6e 200d 0a4d 6963 726f 736f 6674 2057
696e 646f 7773 204e 5420 5365 7276 6572
2034 2e30 200d 0a4d 6963 726f 736f 6674
2057 696e 646f 7773 2032 3030 3020 2020
0d0a 4d69 6372 6f73 6f66 7420 5769 6e64
6f77 7320 5850 2020 0d0a 4d69 6372 6f73
6f66 7420 5769 6e64 6f77 7320 5769 6e39
3820 2020 0d0a 4d69 6372 6f73 6f66 7420
5769 6e64 6f77
11:48:25.193924 I 195.76.65.162.22836 > xxx.yyy.1.2.1027: udp 808
0000 04002800 10000000 00000000 00000000 ..(.............
0010 00000000 00000000 f8917b5a 00ffd011 ..........{Z....
0020 a9b200c0 4fb6e6fc b43c0f22 87127aa4 ....O....<."..z.
0030 bf6015fb 93dc7664 00000000 01000000 .`....vd........
0040 00000000 0000ffff ffffd802 00000000 ................
0050 13000000 00000000 13000000 4d494352 ............MICR
0060 4f534f46 54204e45 54574f52 4b530000 OSOFT NETWORKS..
0070 13000000 00000000 13000000 57494e44 ............WIND
0080 4f575320 55534552 55534552 00000000 OWS USERUSER....
0090 8c020000 00000000 8c020000 4d696372 ............Micr
00a0 6f736f66 74205365 63757269 74792042 osoft Security B
00b0 756c6c65 74696e20 4d533033 2d303433 ulletin MS03-043
00c0 0d0a0d0a 42756666 6572204f 76657272 ....Buffer Overr
00d0 756e2069 6e204d65 7373656e 67657220 un in Messenger
00e0 53657276 69636520 436f756c 6420416c Service Could Al
00f0 6c6f7720 436f6465 20457865 63757469 low Code Executi
0100 6f6e2028 38323830 3335290d 0a0d0a41 on (828035)....A
0110 66666563 74656420 536f6674 77617265 ffected Software
0120 3a200d0a 0d0a4d69 63726f73 6f667420 : ....Microsoft
0130 57696e64 6f777320 4e542057 6f726b73 Windows NT Works
0140 74617469 6f6e200d 0a4d6963 726f736f tation ..Microso
0150 66742057 696e646f 7773204e 54205365 ft Windows NT Se
0160 72766572 20342e30 200d0a4d 6963726f rver 4.0 ..Micro
0170 736f6674 2057696e 646f7773 20323030 soft Windows 200
0180 30202020 0d0a4d69 63726f73 6f667420 0 ..Microsoft
0190 57696e64 6f777320 58502020 0d0a4d69 Windows XP ..Mi
01a0 63726f73 6f667420 57696e64 6f777320 crosoft Windows
01b0 57696e39 38202020 0d0a4d69 63726f73 Win98 ..Micros
01c0 6f667420 57696e64 6f770000 00000000 oft Window......
01d0 00000000 00000000 00000000 00000000 ................
01e0 ........
0320 00000000 00000000 ........
(ttl 118, id 56401)
4500 0344 dc51 0000 7611 ca3b c34c 41a2
xxxx xxxx 5934 0403 0330 0000 0400 2800
1000 0000 0000 0000 0000 0000 0000 0000
0000 0000 f891 7b5a 00ff d011 a9b2 00c0
4fb6 e6fc b43c 0f22 8712 7aa4 bf60 15fb
93dc 7664 0000 0000 0100 0000 0000 0000
0000 ffff ffff d802 0000 0000 1300 0000
0000 0000 1300 0000 4d49 4352 4f53 4f46
5420 4e45 5457 4f52 4b53 0000 1300 0000
0000 0000 1300 0000 5749 4e44 4f57 5320
5553 4552 5553 4552 0000 0000 8c02 0000
0000 0000 8c02 0000 4d69 6372 6f73 6f66
7420 5365 6375 7269 7479 2042 756c 6c65
7469 6e20 4d53 3033 2d30 3433 0d0a 0d0a
4275 6666 6572 204f 7665 7272 756e 2069
6e20 4d65 7373 656e 6765 7220 5365 7276
6963 6520 436f 756c 6420 416c 6c6f 7720
436f 6465 2045 7865 6375 7469 6f6e 2028
3832 3830 3335 290d 0a0d 0a41 6666 6563
7465 6420 536f 6674 7761 7265 3a20 0d0a
0d0a 4d69 6372 6f73 6f66 7420 5769 6e64
6f77 7320 4e54 2057 6f72 6b73 7461 7469
6f6e 200d 0a4d 6963 726f 736f 6674 2057
696e 646f 7773 204e 5420 5365 7276 6572
2034 2e30 200d 0a4d 6963 726f 736f 6674
2057 696e 646f 7773 2032 3030 3020 2020
0d0a 4d69 6372 6f73 6f66 7420 5769 6e64
6f77 7320 5850 2020 0d0a 4d69 6372 6f73
6f66 7420 5769 6e64 6f77 7320 5769 6e39
3820 2020 0d0a 4d69 6372 6f73 6f66 7420
5769 6e64 6f77
--
_+_ From the catapult of |If anyone disagrees with any statement I make, I
_|70|___:)=}- J.D. Baldwin |am quite prepared not only to retract it, but also
\ / [email protected]|to deny under oath that I ever made it. -T. Lehrer
***~~~~-----------------------------------------------------------------------
_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions