RE: RPC Jean Baptist

Thanks Jean , I thought there would be someone else outthere who still knows 
how to use the old tools.


>From: [email protected]
>Reply-To: [email protected]
>To: [email protected]
>Subject: Intrusions Digest, Vol 5, Issue 58
>Date: Tue, 31 Aug 2004 12:22:58 GMT
>
>Send Intrusions mailing list submissions to
>	[email protected]
>
>To subscribe or unsubscribe via the World Wide Web, visit
>	http://www.dshield.org/mailman/listinfo/intrusions
>or, via email, send a message with subject or body 'help' to
>	[email protected]
>
>You can reach the person managing the list at
>	[email protected]
>
>When replying, please edit your Subject line so it is more specific
>than "Re: Contents of Intrusions digest..."
>
>
>Today's Topics:
>
>    1. RE: New Trojan on the block [CIA Trojan] (Smith, Donald)
>    2. Re: Use Rpcdump for Intrusion detection (Jean-Baptiste Marchand)
>
>
>----------------------------------------------------------------------
>
>Message: 1
>Date: Mon, 30 Aug 2004 15:52:30 -0600
>From: "Smith, Donald" <[email protected]>
>Subject: RE: [Intrusions] New Trojan on the block [CIA Trojan]
>To: "Intrusions List \(GCIA Practicals\)" <[email protected]>
>Message-ID:
>	<[email protected]>
>Content-Type: text/plain;	charset="us-ascii"
>
>
>
>[email protected] GCIA
>pgpFingerPrint:9CE4 227B B9B3 601F B500  D076 43F1 0767 AF00 EDCC
>Give a man a fish feed em for a day. Teach em to phish and feed em till
>people quit falling for phishing attempts.
>
> > -----Original Message-----
> > From: [email protected]
> > [mailto:[email protected]] On Behalf Of Nick
> > FitzGerald
> > Sent: Sunday, August 29, 2004 5:08 PM
> > To: [email protected]
> > Subject: Re: [Intrusions] New Trojan on the block [CIA Trojan]
> >
> >
> > Chris Norton wrote:
> >
> > > As far as CIA goes thats what the group who coded it is
> > calling it [not
> > > refering to the government agency] as taken from the readme
> > file CIA 1.23 PB
> > > 1 ( Public Beta 1 ) ...
> >
> > This being but one of dozens of obvious reasons why intelligent anti-
> > malware folk do not name things as their makers wish...
> >
> > <<rest snipped>>
> >
> > I'm intrigued that, according to your first post, you
> > "submitted it to
> > the fine folks at ISC" and later seem
> > surprised/upset/concerned that no
> > AV detect it yet:
> >
> >    As of this writing there are no known AV signatures available to
> >    detect this new trojan and there have been over 2,800 downloads...
> >
> >    ...but the actual client program that infects the machines still
> >    goes by undetected.
> >
> > I have no reason to believe the "fine folks at ISC" will not have,
> > eventually, forwarded samples to their antivirus contacts,
> > but sending
> > such suspect code to a network traffic reporting group, where malware
> > research would seem to be at least a secondary priority, is surely
> > introducing at least one, if not several, unnecessary delays to the
> > process of getting AV detection for something new and perhaps already
> > deployed to close to three thousand machines.
>
>The "fine folks at ISC" do infact submit malware to the av vendors.
>They also have a malware team that does analysis of NEW malware. If you
>provided contact infomation they usually follow up.
>
>
> >
> > For your future reference, here is my standard list of
> > well-known major
> > AV developer suspect file submission addresses.  Note that
> > nowadays it
> > is probably advisable to use the submission method listed for
> > NAI/McAfee for all these addresses (and mention in the accompanying
> > message body that the .ZIP is encrypted and what the password is).
> >
> >    Authentium (Command Antivirus)  <[email protected]>
> >    Computer Associates (US)        <[email protected]>
> >    Computer Associates (Vet/EZ)    <[email protected]>
> >    DialogueScience (Dr. Web)       <[email protected]>
> >    Eset (NOD32)                    <[email protected]>
> >    F-Secure Corp.                  <[email protected]>
> >    Frisk Software (F-PROT)         <[email protected]>
> >    Grisoft (AVG)                   <[email protected]>
> >    H+BEDV (AntiVir, Vexira engine) <[email protected]>
> >    Kaspersky Labs                  <[email protected]>
> >    Network Associates (McAfee)     <[email protected]>
> >      (use a ZIP file with the password 'infected' without the quotes)
> >    Norman (NVC)                    <[email protected]>
> >    Panda Software                  <[email protected]>
> >    Sophos Plc.                     <[email protected]>
> >    Symantec (Norton)               <[email protected]>
> >    Trend Micro (PC-cillin)         <[email protected]>
> >      (Trend may only accept files from users of its products)
> >
> > Most of these addresses are monitored either by 24x365
> > malware support
> > and analysis teams, or have distributed processing around the globe
> > providing (close to) 24x365 coverage.  Several have automated code
> > analysis systems that get the "first look" at submitted files,
> > classifying them for further attention or simply sending back canned
> > reports of the "we detect it in the DEF update that should
> > ship at X or
> > you can download a pre-QA copy at Y".  Depending on the nature of the
> > files you submit, you should get several quite prompt responses, at
> > some of which you'll have to ignore (e.g. a downloader detection is
> > pretty meaningless as the target of a downloader is usually
> > considered
> > to be a non-code variable and ignored by any semi-intelligent
> > detection
> > of that downloader, so the same downloader can be used multiple times
> > configured to snag stuff from different URLs and will always be
> > detected as the same downloader and variant).
> >
> >
> > --
> > Nick FitzGerald
> > Computer Virus Consulting Ltd.
> > Ph/FAX: +64 3 3529854
> >
> > _______________________________________________
> > Intrusions mailing list
> > [email protected]
> > http://www.dshield.org/mailman/listinfo/intrusions
> >
> >
>
>
>------------------------------
>
>Message: 2
>Date: Tue, 31 Aug 2004 10:08:17 +0200
>From: Jean-Baptiste Marchand <[email protected]>
>Subject: Re: [Intrusions] Use Rpcdump for Intrusion detection
>To: "Intrusions List (GCIA Practicals)" <[email protected]>
>Message-ID: <[email protected]>
>Content-Type: text/plain; charset=us-ascii
>
>* lee forrest <[email protected]> [01/01/70 - 01:00]:
>
> > Netstat -ao shows which PID's are opening ports on your machine however 
>if
> > you really want to check the rpc end point mapper database , use
> > RPCDUMP.EXE.
> > So you can quickly check which servers are registered on your machine or 
>a
> > target machine and which interfaces.
>
>rpcdump will only return RPC services that have registered with the
>endpoint mapper.
>
>If you really want to check if a given port is used by a dce rpc
>service, you must use the ifids program:
>
>http://www.hsc.fr/ressources/presentations/hivercon03/img59.html
>
>
>Demonstration of ifids against RPC services listening on named pipes
>(SMB transport):
>
>http://www.hsc.fr/ressources/presentations/sambaxp2003/slide24.html
>
>
>Open-source versions of rpcdump and ifids (written by Todd Sabin) are
>available at:
>
>http://www.bindview.com/Support/RAZOR/Utilities/Windows/rpctools1.0-readme.cfm
>
>
>Jean-Baptiste Marchand
>--
>[email protected]
>HSC - http://www.hsc.fr/
>
>
>------------------------------
>
>_______________________________________________
>Intrusions mailing list
>[email protected]
>http://www.dshield.org/mailman/listinfo/intrusions
>
>
>End of Intrusions Digest, Vol 5, Issue 58
>*****************************************

_________________________________________________________________
Stay in touch with absent friends - get MSN Messenger 
http://www.msn.co.uk/messenger

_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions