Hackers Handbook - Millenium Edition/Hackers Handbook.iso/library/hack99/windows_backdoors.txt

Internet Message Format | 1999-03-24 | 12.3 KB

Date: Fri, 19 Feb 1999 20:02:46 -0500 (EST)
From: X-Force <[e-mail]>
To: [e-mail]
Cc: X-Force <[e-mail]>
Subject: ISSalert: ISS Vulnerability Alert: Windows Backdoors Update II

TO UNSUBSCRIBE: email "unsubscribe alert" in the body of your message to
[e-mail]  Contact [e-mail] for help with any problems!
---------------------------------------------------------------------------


-----BEGIN PGP SIGNED MESSAGE-----

ISS Vulnerability Alert
February 19, 1999

Windows Backdoors Update II:
NetBus 2.0 Pro, Caligula, and Picture.exe

Synopsis:

This advisory is a quarterly update on backdoors for the Windows 9x and
Windows NT operating systems. The focus of this advisory is NetBus 2.0
Pro. The final version of NetBus 2.0 Pro was released on February 19. The
new version of NetBus is not distributed as a backdoor, but as a "Remote
Administration and Spy Tool." Due to the proliferation of NetBus
and its common use in attacks across the Internet, NetBus 2.0 poses a
significant risk with its new functionality and enhanced network
communication obfuscation.  The default installation of NetBus 2.0 Pro
(NB2) does not hide itself from the user, but it does support an
"Invisible Mode" to prevent users of infected machines from noticing the
software. The version of NB2 available on the Internet notifies users upon
installation, however attackers can easily hide the installation with
slight modification.

This ISS X-Force Security Alert also includes information about the
Picture.exe trojan and the Caligula macro virus, since the presence
of either of those on your system could lead to a compromise of security
and transmission of sensitive data over the Internet.

NetBus 2.0 Pro Description:

NB2 includes enhanced functionality, including the ability to find cached
passwords, full control over all windows, capturing video from a video
input device, a scheduler to run scripts on specified hosts at a certain
time, and support for plugins. Plugins will enable programmers at add
functionality to NB2, similar to the architecture provided in the cDc
BackOrifice backdoor.  The only plugin currently available is a
file-finding utility that searches a victim's hard drive for files.

By default, NB2 listens on TCP port 20034, but this is easily
configurable. NB2 uses a weak form of encryption to obfuscate its
communications, but the format of its packets makes it easy to spot NB2
traffic. Each packet starts with 'BN', followed by the following sequence:

- - - - Two bytes representing the length of the packet.
- - - - Two bytes of 0x02 or 0x00, probably for the version of NetBus.
- - - - Two random bytes, probably to confuse people.
- - - - Two bytes for the command code.

For example:

42 4E XX XX 02 00 YY YY ZZ ZZ ...data...

XX XX is the length of the whole NetBus 2.0 packet
YY YY are just two random bytes
ZZ ZZ is the command code

The first 2 bytes are 'BN', the length of the packet is XX XX, and the
version is 0x02.

NB2 stores registry information in the HKEY_CURRENT_USER\NetBus Server
registry key. If you have this key in your registry, NB2 may be running on
your machine. To determine the port that NB2 uses, check the value of
HKEY_CURRENT_USER\NetBus Server\General\TCPPort, and use the 'netstat -an
| find "LISTEN"' command to see if your system is listening on that port.
If NB2 is listening, you need to find the NB2 server executable and delete
it. The default name is NbSvr.exe, but it can be easily renamed.

If NetBus 2.0 is configured to start automatically when your computer
boots, the
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
registry key will have a registry value called 'NetBus Server Pro' that
specifies the full path for the location of the NetBus executable. Use
the registry key value to locate and delete the file if you find that
NB2 has been installed on your machine without permission.

NetBus 2.0 traffic using the default port can be detected by RealSecure if
you configure it to monitor traffic on TCP port 20034.

Caligula Description:

The WM97/Caligula virus was released by 'Codebreakers', a virus exchange
(Vx) group. This is a Microsoft Word macro virus that steals your Pretty
Good Privacy (PGP) secret key ring and uploads it to a Codebreakers FTP
site. When executed, this virus will open the registry and look for the
HKEY_CLASSES_ROOT\PGP Encrypted File\shell\open\command registry value.
The virus uses this value to find the path to the PGP program. Once it
finds the path to PGP, the virus locates your secret key ring, located in
the secring.skr file. The virus copies this file to a file called
secringXXXX.skr, where each X is an integer from 0 to 7, for example,
secring3150.skr. This file is uploaded to an FTP site at 208.201.88.110,
or ftp.codebreakers.org, and stored in the incoming directory.

After Caligula runs, it sets the registry value
HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info\Caligula to
1 (True). You can tell if you have the Caligula virus by looking for that
key in the registry.

An infection by Caligula can be detected by RealSecure if you configure
it to look for FTP connections to 208.201.88.110.

Picture.exe Description:

The Picture.exe trojan horse program has been circulating around the
Internet via an e-mail attachment. If run, this executable will send
information about your Windows NT or 95/98 system to any of several e-mail
addresses in China. The file has also been seen with the name Manager.exe.

Executing or opening Picture.exe places a file called note.exe in your
Windows directory. It also adds the line "RUN=NOTE.EXE" to the win.ini
file so note.exe runs every time Windows boots. The first time that
note.exe runs, it creates a file in your Windows directory called
$2321.Dat. This file contains an encoded listing of all of the files whose
three-letter file name extensions begin with an h, i, m, p, s, or t. ISS
X-Force believes it was the author's intent to get files whose extensions
are .idx, .mdb, .pst, .htm, .snm, .pab, and .txt, because those extensions
show up in note.exe. However, note.exe will list any file whose extension
begins with those letters. Earlier reports indicated that note.exe looks
through a user's web cache directories to determine which web sites the
user visited, but this claim is false. Note.exe looks through all
directories trying to gather e-mail addresses.

The data in the file created by note.exe is encoded by adding 5 to each
character's ASCII code, for example:

C:\Inetpub\iissamples\ISSamples\default.htm

becomes:

H?aNsjyuzgannxxfruqjxaNXXfruqjxaijkfzqy3myr

The second time note.exe runs, it searches all files for e-mail addresses.
When it finds an address, it encodes and writes the address to a file
called $4135.Dat in your Windows directory. The way that this data is
encoded is by subracting 5 from each character's ASCII code, for example:

[e-mail]

becomes:

sajm^`;dnn)i`o

After note.exe searches all of the files, it overwrites $4135.Dat with
compressed data, where every host name is only listed once. It encodes the
data by subtracting 5 from each character's ASCII code, and ends each line
with ~X or =~X, where X is an integer. The lines that end in ~X are
usernames, and the lines that end in =~X are host names. Once decoded, the
format of the data looks like this:

root~1
xforce~1
support~2
iss.net=~1
microsoft.com=~2

Each username is matched with the corresponding host name. In this
example, the e-mail addresses are: [e-mail], [e-mail], and
[e-mail].

The third time note.exe runs, it attempts to send the contents of
$4135.Dat to any of several e-mail addresses. The addresses ISS X-Force
have identified are [e-mail], [e-mail],
[e-mail], and [e-mail].

The trojan tries to connect to various SMTP servers. ISS X-Force has
identified public2.lyptt.ha.cn, public1.sta.net.cn, nenpub.szptt.net.cn,
mail.capital-online.com.cn, public2.lyptt.ha.cn, public.cc.jl.cn,
pub1.fz.fj.cn, public.szonline.net, and mail.nn.gx.cn. The data is Base64
encoded.

A header detected from an e-mail sent by note.exe is as follows:

>From: ab<[e-mail]>
To: [e-mail]
Subject: A manager software from ZDNet_AU
X-Mailer: Microsoft Outlook Express 4.72
Mime-Version: 1.0
Content-Type: multipart/mixed;
boundary="====================545354:56:00.PM===="

If sending the e-mail succeeds, note.exe will delete $2321.Dat and
$4135.Dat. If sending fails, it will try again the next time note.exe
runs, and keep trying until it successfully sends the e-mail.

Earlier reports also stated that note.exe looks for AOL account
information on your computer, because it reads the MAIN.IDX file in your
AOL directory. ISS X-Force believes that this statement is false. The
program searches the hard drive for .idx files, because it is looking for
e-mail addresses, and Microsoft Outlook uses .idx files for keeping track
of e-mail in your mail folders. On a machine with AOL 4.0 installed,
note.exe does read the MAIN.IDX file in the AOL directory, but the
username and password information is never sent to the e-mail addresses in
China.


Recommendations:

It would be difficult to manually search all of your machines to make
sure no backdoors are running, so the best way to protect yourself is
to not run any untrusted binaries. You should NEVER run any program sent
to you over IRC, ICQ, or any other chat medium, as it is quite easy to
spoof or impersonate even trusted users, and you can never tell if the
person sending you the program is who they claim to be. Don't run any
program sent to you via e-mail unless it is digitally signed. It is
trivial to fake the sender's address, and you don't know who actually sent
the e-mail. Also, be very careful when running programs you download from
the Internet or the World Wide Web. Isolating your machines behind a
firewall will help prevent attackers from connecting to any backdoors
installed on your machine, but it may be possible for them to bypass the
firewall if the backdoor is listening on a port that is left open on the
firewall, for example, the port DNS uses for its operations.

If you find yourself infected with the Picture.exe trojan or the Caligula
macro virus, you should run an anti-virus program to get rid of it.

For more information:

NetBus can be downloaded from http://netbus.nu.

________

Copyright (c) 1999 by Internet Security Systems, Inc.  Permission is
hereby granted for the electronic redistribution of this Security Alert.
It is not to be edited in any way without express consent of the X-Force.
If you wish to reprint the whole or any part of this Alert Summary in any
other medium excluding electronic medium, please e-mail [e-mail] for
permission.

Internet Security Systems, Inc. (ISS) is the leading provider of adaptive
network security monitoring, detection, and response software that
protects the security and integrity of enterprise information systems.  By
dynamically detecting and responding to security vulnerabilities and
threats inherent in open systems, ISS's SAFEsuite family of products
provide protection across the enterprise, including the Internet,
extranets, and internal networks, from attacks, misuse, and security
policy violations.  ISS has delivered its adaptive network security
solutions to organizations worldwide, including firms in the Global 2000,
nine of the ten largest U.S. commercial banks, and over 35 governmental
agencies.  For more information, call ISS at 678-443-6000 or 800-776-2362
or visit the ISS Web site at http://www.iss.net..

Disclaimer
The information within this paper may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are NO warranties with regard to this information. In no event shall the
author be liable for any damages whatsoever arising out of or in
connection with the use or spread of this information. Any use of this
information is at the user's own risk.

X-Force PGP Key available at:   http://www.iss.net/xforce/sensitive.html
as well as on MIT's PGP key server and PGP.com's key server.

Please send suggestions, updates, and comments to:
X-Force <[e-mail]> of Internet Security Systems, Inc.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: noconv

iQCVAwUBNs4H8DRfJiV99eG9AQEzLAP/UrxikH1CpUzOr2wKqe3brD60atbvGr0y
TEYTi4oFBKAtlg4cDgRlXWA3UGOqzqvB5lc4eEMv1vgKXG0zmFpaPFMpcLP9dtPd
e/XDQ/ixESG7MhXHltK8MFJPGyDV3Fz1vwjukUhcqlNmnHqCXcnCnOntjV7zG8Eh
dyDGQ1cVA18=
=n9in
-----END PGP SIGNATURE-----