[VulnDiscuss] SOBIG.G Wrap-Up
Dragos Ruiu <[email protected]> Thu, 25 Sep 2003 20:26:57 -0700
| Newsgroups | gmane.comp.security.vulnerabilities.watch.general |
|---|---|
| Organization | All Terrain Ninjas |
| Message-ID | <[email protected]> |
I will defer to the knowledge of more experienced virus hunters who assure me that the samples are the all the same despite the incriminating looking binary differences. Attached at the bottom is the old vs new binary difference cluster (regions of modifications) analysis that led me to conclude something might be interesting. (To demonstrate that I'm not completely delusional :-). The fact that these timewarp virii are still just trickling in as opposed to flooding (the ramp up last night tapered off eventually) basically convinces me that the outside chance that the compilation dates were not touched in some binary munging, is an unlikely improbability. Good news really, because I have better things to be worrying about than more filtering. Some interesting points did come up in the discussion and I learned a couple of cool things, Joe Stewart from lurhq.com had the most convincing and simple analysis and also added another nifty little trick to my forensics tool kit (thanks!). It is included below. Also educational was the discussion of using REJECT vs. DISCARD in the Postfix blocks. So thanks to all who provided brainpower. (See Liviu Daia's excellent Postfix advice at the bottom, for the Linux folks Gregor Lawatscheck iptables-foo was pretty nifty too also below.) It's still odd that the new ones differ so much from the old ones (maybe some side effect of the telock wrapping?), but at this point I have to worry much more about preparations for Japan than this nonsense so I'm calling this case closed, and leave investigation of Internet time warps as an excercise for the reader. In the interest of non-proliferation (:-) I've taken the sample archive off the web server and you'll have to mail me if you want it. thanks, --dr On September 25, 2003 01:40 pm, Joe Stewart wrote: > It's probably from someone with their system date set back before the > Sobig.f cutoff. You can easily differentiate between Sobig versions by > reading the PE timestamp field. Below you can find a short Perl script > I wrote to automate the process of retrieving the PE timestamp from an > executable. Not every compiler sets this field with the compile date, > but the one the Sobig author uses does (VC++). > > If your pif sample was not compiled on Sun Aug 17 12:54:53 2003 then you > have a different variant. On September 25, 2003 01:40 pm, Joe Stewart wrote: > #!/usr/bin/perl > > # read-pe-timestamp.pl > # by Joe Stewart <[email protected]> > # usage: ./read-pe-timestamp.pl <PE file> > # tested on Linux; Win32 users may need to add binmode() > > use strict; > > my $filename = $ARGV[0]; > my $now = time; > my $old = 800000000; > die "Usage: $0 <PE file>\n" unless $filename; > open(IN, $filename) or die "Couldn't open $filename : $!\n"; > for (0..255) { > my $dword; > read(IN, $dword, 4); > next unless $dword eq "PE\x00\x00"; > read(IN, $dword, 4); > read(IN, $dword, 4); > my $t = unpack("N*", reverse($dword)); > my $time = localtime($t); > print "$filename was compiled on $time\n"; > print "(Probably erroneous)\n" if ($t >= $now || $t <= $old); > close IN; > exit; > } > close IN; > print "Could not find PE header in $filename\.\n"; On September 25, 2003 02:50 pm, Joe wrote: > All are Sobig.f: > ./gdocument_9446.pif was compiled on Sun Aug 17 12:54:53 2003 > ./gdetails.pif was compiled on Sun Aug 17 12:54:53 2003 > ./gdetails2.pif was compiled on Sun Aug 17 12:54:53 2003 > ./gthank_you.pif was compiled on Sun Aug 17 12:54:53 2003 > ./gdocument_9446-2.pif was compiled on Sun Aug 17 12:54:53 2003 > ./gdocument_all.pif was compiled on Sun Aug 17 12:54:53 2003 > ./gdocument_all2.pif was compiled on Sun Aug 17 12:54:53 2003 > ./gdetails3.pif was compiled on Sun Aug 17 12:54:53 2003 > ./gthank_you2.pif was compiled on Sun Aug 17 12:54:53 2003 > ./fthank_you2.pif was compiled on Sun Aug 17 12:54:53 2003 > ./fthank_you.pif was compiled on Sun Aug 17 12:54:53 2003 > ./fdetails.pif was compiled on Sun Aug 17 12:54:53 2003 > ./fyour_details.pif was compiled on Sun Aug 17 12:54:53 2003 This was the binary difference comparison that led me astray by the way. The number is the difference clusters in the samples. (f = old, g = new) (the d diffs are comparisons among the groups and the dx comparisons are cross group.) SOBIG.F (early Sept) Difference Cluster Comparison: --------------------------------------------------- d-fdetails.pif.hex-fapplication.pif.hex 1 d-fdetails.pif.hex-fthank_you.pif.hex 1 d-fdetails.pif.hex-fthank_you2.pif.hex 1 d-fdetails.pif.hex-fyour_details.pif.hex 1 d-fthank_you.pif.hex-fdetails.pif.hex 1 d-fthank_you.pif.hex-fthank_you2.pif.hex 1 d-fthank_you.pif.hex-fyour_details.pif.hex 1 d-fthank_you2.pif.hex-fdetails.pif.hex 1 d-fthank_you2.pif.hex-fthank_you.pif.hex 1 d-fthank_you2.pif.hex-fyour_details.pif.hex 1 d-fyour_details.pif.hex-fdetails.pif.hex 1 d-fyour_details.pif.hex-fthank_you.pif.hex 1 d-fyour_details.pif.hex-fthank_you2.pif.hex 1 SOBIG.G(Received Yesterday) Difference Cluster comparisons: ----------------------------------------------------------- d-gdetails.pif.hex-gdetails2.pif.hex 1 d-gdetails.pif.hex-gdetails3.pif.hex 1 d-gdetails.pif.hex-gdocument_9446-2.pif.hex 1 d-gdetails.pif.hex-gdocument_9446.pif.hex 1 d-gdetails.pif.hex-gdocument_all.pif.hex 1 d-gdetails.pif.hex-gdocument_all2.pif.hex 1 d-gdetails.pif.hex-gthank_you.pif.hex 1 d-gdetails.pif.hex-gthank_you2.pif.hex 1 d-gdetails2.pif.hex-gdetails.pif.hex 1 d-gdetails2.pif.hex-gdetails3.pif.hex 1 d-gdetails2.pif.hex-gdocument_9446-2.pif.hex 1 d-gdetails2.pif.hex-gdocument_9446.pif.hex 1 d-gdetails2.pif.hex-gdocument_all.pif.hex 1 d-gdetails2.pif.hex-gdocument_all2.pif.hex 1 d-gdetails2.pif.hex-gthank_you.pif.hex 1 d-gdetails2.pif.hex-gthank_you2.pif.hex 1 d-gdetails3.pif.hex-gdetails.pif.hex 1 d-gdetails3.pif.hex-gdetails2.pif.hex 1 d-gdetails3.pif.hex-gdocument_9446-2.pif.hex 1 d-gdetails3.pif.hex-gdocument_9446.pif.hex 1 d-gdetails3.pif.hex-gdocument_all.pif.hex 1 d-gdetails3.pif.hex-gdocument_all2.pif.hex 1 d-gdetails3.pif.hex-gthank_you.pif.hex 1 d-gdetails3.pif.hex-gthank_you2.pif.hex 1 d-gdocument_9446-2.pif.hex-gdetails.pif.hex 1 d-gdocument_9446-2.pif.hex-gdetails2.pif.hex 1 d-gdocument_9446-2.pif.hex-gdetails3.pif.hex 1 d-gdocument_9446-2.pif.hex-gdocument_9446.pif.hex 1 d-gdocument_9446-2.pif.hex-gdocument_all.pif.hex 1 d-gdocument_9446-2.pif.hex-gdocument_all2.pif.hex 1 d-gdocument_9446-2.pif.hex-gthank_you.pif.hex 1 d-gdocument_9446-2.pif.hex-gthank_you2.pif.hex 1 d-gdocument_9446.pif.hex-gdetails.pif.hex 1 d-gdocument_9446.pif.hex-gdetails2.pif.hex 1 d-gdocument_9446.pif.hex-gdetails3.pif.hex 1 d-gdocument_9446.pif.hex-gdocument_9446-2.pif.hex 1 d-gdocument_9446.pif.hex-gdocument_all.pif.hex 1 d-gdocument_9446.pif.hex-gdocument_all2.pif.hex 1 d-gdocument_9446.pif.hex-gthank_you.pif.hex 1 d-gdocument_9446.pif.hex-gthank_you2.pif.hex 1 d-gdocument_all.pif.hex-gdetails.pif.hex 1 d-gdocument_all.pif.hex-gdetails2.pif.hex 1 d-gdocument_all.pif.hex-gdetails3.pif.hex 1 d-gdocument_all.pif.hex-gdocument_9446-2.pif.hex 1 d-gdocument_all.pif.hex-gdocument_9446.pif.hex 1 d-gdocument_all.pif.hex-gdocument_all2.pif.hex 1 d-gdocument_all.pif.hex-gthank_you.pif.hex 1 d-gdocument_all.pif.hex-gthank_you2.pif.hex 1 d-gdocument_all2.pif.hex-gdetails.pif.hex 1 d-gdocument_all2.pif.hex-gdetails2.pif.hex 1 d-gdocument_all2.pif.hex-gdetails3.pif.hex 1 d-gdocument_all2.pif.hex-gdocument_9446-2.pif.hex 1 d-gdocument_all2.pif.hex-gdocument_9446.pif.hex 1 d-gdocument_all2.pif.hex-gdocument_all.pif.hex 1 d-gdocument_all2.pif.hex-gthank_you.pif.hex 1 d-gdocument_all2.pif.hex-gthank_you2.pif.hex 1 d-gthank_you.pif.hex-gdetails.pif.hex 1 d-gthank_you.pif.hex-gdetails2.pif.hex 1 d-gthank_you.pif.hex-gdetails3.pif.hex 1 d-gthank_you.pif.hex-gdocument_9446-2.pif.hex 1 d-gthank_you.pif.hex-gdocument_9446.pif.hex 1 d-gthank_you.pif.hex-gdocument_all.pif.hex 1 d-gthank_you.pif.hex-gdocument_all2.pif.hex 1 d-gthank_you.pif.hex-gthank_you2.pif.hex 1 d-gthank_you2.pif.hex-gdetails.pif.hex 1 d-gthank_you2.pif.hex-gdetails2.pif.hex 1 d-gthank_you2.pif.hex-gdetails3.pif.hex 1 d-gthank_you2.pif.hex-gdocument_9446-2.pif.hex 1 d-gthank_you2.pif.hex-gdocument_9446.pif.hex 1 d-gthank_you2.pif.hex-gdocument_all.pif.hex 1 d-gthank_you2.pif.hex-gdocument_all2.pif.hex 1 d-gthank_you2.pif.hex-gthank_you.pif.hex 1 SOBIG.F vs. SOBIG.G Difference Clusters: ---------------------------------------- dx-fdetails.pif.hex-gdetails.pif.hex 6 dx-fdetails.pif.hex-gdetails2.pif.hex 3 dx-fdetails.pif.hex-gdetails3.pif.hex 6 dx-fdetails.pif.hex-gdocument_9446-2.pif.hex 3 dx-fdetails.pif.hex-gdocument_9446.pif.hex 6 dx-fdetails.pif.hex-gdocument_all.pif.hex 3 dx-fdetails.pif.hex-gdocument_all2.pif.hex 3 dx-fdetails.pif.hex-gthank_you.pif.hex 6 dx-fdetails.pif.hex-gthank_you2.pif.hex 4 dx-fthank_you.pif.hex-gdetails.pif.hex 3 dx-fthank_you.pif.hex-gdetails2.pif.hex 2 dx-fthank_you.pif.hex-gdetails3.pif.hex 2 dx-fthank_you.pif.hex-gdocument_9446-2.pif.hex 3 dx-fthank_you.pif.hex-gdocument_9446.pif.hex 2 dx-fthank_you.pif.hex-gdocument_all.pif.hex 2 dx-fthank_you.pif.hex-gdocument_all2.pif.hex 2 dx-fthank_you.pif.hex-gthank_you.pif.hex 2 dx-fthank_you.pif.hex-gthank_you2.pif.hex 3 dx-fthank_you2.pif.hex-gdetails.pif.hex 6 dx-fthank_you2.pif.hex-gdetails2.pif.hex 5 dx-fthank_you2.pif.hex-gdetails3.pif.hex 5 dx-fthank_you2.pif.hex-gdocument_9446-2.pif.hex 4 dx-fthank_you2.pif.hex-gdocument_9446.pif.hex 5 dx-fthank_you2.pif.hex-gdocument_all.pif.hex 4 dx-fthank_you2.pif.hex-gdocument_all2.pif.hex 4 dx-fthank_you2.pif.hex-gthank_you.pif.hex 5 dx-fthank_you2.pif.hex-gthank_you2.pif.hex 3 dx-fyour_details.pif.hex-gdetails.pif.hex 5 dx-fyour_details.pif.hex-gdetails2.pif.hex 7 dx-fyour_details.pif.hex-gdetails3.pif.hex 5 dx-fyour_details.pif.hex-gdocument_9446-2.pif.hex 5 dx-fyour_details.pif.hex-gdocument_9446.pif.hex 5 dx-fyour_details.pif.hex-gdocument_all.pif.hex 7 dx-fyour_details.pif.hex-gdocument_all2.pif.hex 5 dx-fyour_details.pif.hex-gthank_you.pif.hex 5 dx-fyour_details.pif.hex-gthank_you2.pif.hex 3 On September 25, 2003 12:03 pm, Liviu Daia wrote: > Your recipe uses a regexp map, not a pcre one, it's very slow > (especially on OpenBSD), and incomplete. Here's a better one: > > (1) Make sure you have Postfix 2.0.x, compiled with support for PCRE. > Run this to find out: > postconf -d mail_version > postconf -m | grep pcre > (2) Add this to main.cf: > mime_header_checks = pcre:/etc/postfix/mime_header_checks.pcre> > (3) Put this in /etc/postfix/mime_header_checks.pcre (the last pattern > is supposed to catch CLSID extensions): > /^Content-(?:Disposition:\s+attachment;|Type:).*\b(?:file)?name\s*=.*\.(?: > ad[ep] | > asd | > ba[st] | > chm | > cmd | > com(?=$|") | > cpl | > crt | > dll | > eml | > exe | > hlp | > hta | > in[fs] | > isp | > jse? | > lnk | > md[betw] | > ms[cipt] | > nws | > ocx | > ops | > pcd | > p[ir]f | > reg | > sc[frt] | > sh[bsm] | > swf | > url | > vb[esx]? | > vxd | > ws[cfh] | > \{[[:xdigit:]]{8}(?:-[[:xdigit:]]{4}){3}-[[:xdigit:]]{12}\} > )\b/x REJECT Windows executables not allowed > > Change REJECT above to DISCARD at attack peak times, to save other > machines the trouble of bouncing your rejects. Of course, collateral > damages of the discards are to be expected too. On September 25, 2003 10:00 am, Gregor Lawatscheck wrote: > Slightly off-topic but my recommendation would be to get the "recent" and > "string" module for iptables and configure something like this > > iptables -N BADATTACH > iptables -A BADATTACH -j LOG --log-level info --log-prefix "DROP bad > attachment" > > iptables -A BADATTACH -m recent --name SOBIGF --set -j REJECT > > iptables -A FORWARD -p TCP --destination xxx.xxx.xxx.xxx --dport 25 -m > recent --rcheck --name SOBIGF --seconds 200 -j DROP > > iptables -A FORWARD -p TCP -i eth0 --tcp-flags ACK ACK --destination > 80.239.136.137 --dport 25 -j -m string --string > "name=\"your_document.pif\"" -j BADATTACH > > and so forth for other attachment names. Maybe there is a "better" way of > doing this - like cutting off all MS executables and asking people to send > .zips > > Then put the timeout for an SMTP connection in your MTA to 15 seconds or > so... saved a lot of traffic here. > > What you have now is iptables cutting off the connection right when it > tries to send the filename and putting the IP in a ban list for 200 > seconds. After 200 seconds the MTA on the other side may try again - only > to be shut off again for 200 seconds if it keeps sending the virus. 200 > seconds works fine to still receive legitimate mails from large freemailers > which send the virus occacionaly. -- Top security experts. Cutting edge tools, techniques and information. Tokyo, Japan November, 2003 http://www.pacsec.jp pgpkey http://dragos.com/ kyxpgp