Blaster (computer worm)

Hex dump of the Blaster worm, showing a message left for Microsoft Technology Advisor Bill Gates by the worm programmer

The Blaster Worm (also known as Lovsan, Lovesan or MSBlast) was a computer worm that spread on computers running the Microsoft operating systems Windows XP and Windows 2000, during August 2003.[1]

The worm was first noticed and started spreading on August 11, 2003. The rate that it spread increased until the number of infections peaked on August 13, 2003. Once a network (such as a company or university) was infected, it spread quicker within the network because firewalls typically did not prevent internal machines from using a certain port.[2] Filtering by ISPs and widespread publicity about the worm curbed the spread of Blaster.

On March 12, 2004, Jeffrey Lee Parson, an 18-year-old from Hopkins, Minnesota, was arrested for creating the B variant of the Blaster worm; he admitted responsibility and was sentenced to an 18-month prison term in January 2005.[3]

Creation and effects

According to court papers, the original Blaster was created after security researchers from the Chinese group Xfocus reverse engineered the original Microsoft patch that allowed for execution of the attack.[4]

The worm spread by exploiting a buffer overflow discovered by the Polish security research group Last Stage of Delirium[5] in the DCOM RPC service on the affected operating systems, for which a patch had been released one month earlier in MS03-026 and later in MS03-039. This allowed the worm to spread without users opening attachments simply by spamming itself to large numbers of random IP addresses. Four versions have been detected in the wild.[6] These are the most well known exploits of the original flaw in RPC, but there were in fact another 12 different vulnerabilities which never saw very much media attention.[7]

The worm was programmed to start a SYN flood against port 80 of windowsupdate.com if the system date is after August 15 and before December 31st and after the 15th day of other months, thereby creating a distributed denial of service attack (DDoS) against the site.[8] The damage to Microsoft was minimal as the site targeted was windowsupdate.com, rather than windowsupdate.microsoft.com to which the former was redirected. Microsoft temporarily shut down the targeted site to minimize potential effects from the worm.

The worm's executable, MSBlast.exe,[9] contains two messages. The first reads:

I just want to say LOVE YOU SAN!!

This message gave the worm the alternative name of Lovesan. The second reads:

billy gates why do you make this possible ? Stop making money
and fix your software!!

This is a message to Bill Gates, the co-founder of Microsoft and the target of the worm.

The worm also creates the following registry entry so that it is launched every time Windows starts:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ windows auto update=msblast.exe

Timeline

Side effects

Although the worm can only spread on systems running Windows 2000 or Windows XP (32 bit) it can cause instability in the RPC service on systems running Windows NT, Windows XP (64 bit), and Windows Server 2003. In particular, the worm does not spread in Windows Server 2003 because Windows Server 2003 was compiled with the /GS switch, which detected the buffer overflow and shut the RPCSS process down.[31] When infection occurs, the buffer overflow causes the RPC service to crash, leading Windows to display the following message and then automatically reboot, usually after 60 seconds.[32]

System Shutdown:

This system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by NT AUTHORITY\SYSTEM

Time before shutdown: hours:minutes:seconds

Message:

Windows must now restart because the Remote Procedure Call (RPC) Service terminated unexpectedly.

This was the first indication many users had an infection; it often occurred a few minutes after every startup on compromised machines. A simple resolution to stop countdown is to run the "shutdown /a" command in the Windows command line,[33] causing some side effects such as an empty (without users) Welcome Screen.[34] The Welchia worm had a similar effect. Months later, the Sasser worm surfaced, which caused a similar message to appear.

See also

References

  1. "CERT Advisory CA-2003-20 W32/Blaster worm". Cert.org. Retrieved 2010-09-23.
  2. 1 2 3 "MS03-026: Buffer Overrun in RPC May Allow Code Execution".
  3. "Blaster worm author gets jail time". infoworld. 28 January 2005. Retrieved 8 June 2014. An 18-month prison sentence is probably the best that Jeffrey Parson could have realistically hoped for. The U.S. authorities have demonstrated their determination to deal with virus writers and other cybercriminals," said Graham Cluley, senior technology consultant for security software company Sophos
  4. Iain Thomson. "FBI arrests 'stupid' Blaster.B suspect - V3.co.uk - formerly". vnunet.com. Retrieved 2010-09-23.
  5. "MSBlast W32.Blaster.Worm / LovSan :: removal instructions". Able2know.org. 2003-08-12. Retrieved 2010-09-23.
  6. "W32.Blaster.Worm". Symantec. Retrieved 2010-09-23.
  7. The Lifecycle of a Vulnerability (PDF). internet Security Systems, Inc. 2005. p. 3. Retrieved June 8, 2014.
  8. "W32.Blaster.Worm : Technical details". symantec.com. December 9, 2003. External link in |publisher= (help)
  9. "Worm:Win32/Msblast.A". Malware encyclopedia. Microsoft Corporation. Retrieved 2014-06-10.
  10. The Welchia Worm. pp. 14, 17. Retrieved 9 June 2014.
  11. "MS03-013: Buffer overrun in Windows kernel message handling could lead to elevated privileges". Retrieved 9 June 2014.
  12. "Flaw In Microsoft Windows RPC Implementation".
  13. 1 2 "'MSBlast' / LovSan Write up URL: http://able2know.org/topic/10489-1". Forum article on "able2know". Retrieved 9 June 2014. External link in |title= (help)
  14. 1 2 Buffer Overflow in Microsoft RPC http://www.cert.org/historical/advisories/CA-2003-16.cfm. Missing or empty |title= (help)
  15. "The Analysis of LSD's Buffer Overrun in Windows RPC Interface". July 25, 2003. Retrieved 9 June 2014.
  16. "Malware FAQ: What is W32/Blaster worm?" (PDF).
  17. 1 2 3 4 "Blaster worm spreading, experts warn of attack".
  18. "W32.Blaster.Worm".
  19. "New Blaster worm variant on the loose".
  20. "Blaster worm attack a bust".
  21. "Virus alert about the Nachi worm".
  22. "W32.Welchia.Worm".
  23. "'Friendly' Welchia Worm Wreaking Havoc". Retrieved 9 June 2014.
  24. 1 2 3 "Virus Profile: W32/Lovsan.worm.a".
  25. "W32.Blaster.Worm".
  26. "W32.Welchia.Worm". Retrieved 10 June 2014.
  27. "tool is available to remove Blaster worm and Nachi worm infections from computers that are running Windows 2000 or Windows XP".
  28. "W32.Welchia.C.Worm". Retrieved 9 June 2014.
  29. "W32.Welchia.Worm". Retrieved 9 June 2014.
  30. "Minnesota Man Sentenced to 18 Months in Prison for Creating and Unleashing a Variant of the MS Blaster Computer Worm". Retrieved 10 June 2014.
  31. "Why Blaster did not infect Windows Server 2003 - Michael Howard's Web Log - Site Home - MSDN Blogs". Blogs.msdn.com. 2004-05-26. Retrieved 2010-09-23.
  32. "Blaster technical details - Trend Micro Threat Encyclopedia". Trendmicro.com. Retrieved 2011-03-25.
  33. "Blaster Worm-Virus or Its Variants Cause the Computer to Shutdown with an NT AUTHORITY\SYSTEM Error Message Regarding Remote Procedure Call (RPC) Service". HP Customer Care.
  34. "What is the Blaster Worm". Techopedia. Retrieved 14 February 2013.
This article is issued from Wikipedia - version of the Thursday, March 24, 2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.