Date: Fri, 19 Feb 1999 20:02:46 -0500 (EST) From: X-Force To: alert@iss.net Cc: X-Force Subject: ISSalert: ISS Vulnerability Alert: Windows Backdoors Update II TO UNSUBSCRIBE: email "unsubscribe alert" in the body of your message to majordomo@iss.net Contact alert-owner@iss.net for help with any problems! --------------------------------------------------------------------------- -----BEGIN PGP SIGNED MESSAGE----- ISS Vulnerability Alert February 19, 1999 Windows Backdoors Update II: NetBus 2.0 Pro, Caligula, and Picture.exe Synopsis: This advisory is a quarterly update on backdoors for the Windows 9x and Windows NT operating systems. The focus of this advisory is NetBus 2.0 Pro. The final version of NetBus 2.0 Pro was released on February 19. The new version of NetBus is not distributed as a backdoor, but as a "Remote Administration and Spy Tool." Due to the proliferation of NetBus and its common use in attacks across the Internet, NetBus 2.0 poses a significant risk with its new functionality and enhanced network communication obfuscation. The default installation of NetBus 2.0 Pro (NB2) does not hide itself from the user, but it does support an "Invisible Mode" to prevent users of infected machines from noticing the software. The version of NB2 available on the Internet notifies users upon installation, however attackers can easily hide the installation with slight modification. This ISS X-Force Security Alert also includes information about the Picture.exe trojan and the Caligula macro virus, since the presence of either of those on your system could lead to a compromise of security and transmission of sensitive data over the Internet. NetBus 2.0 Pro Description: NB2 includes enhanced functionality, including the ability to find cached passwords, full control over all windows, capturing video from a video input device, a scheduler to run scripts on specified hosts at a certain time, and support for plugins. Plugins will enable programmers at add functionality to NB2, similar to the architecture provided in the cDc BackOrifice backdoor. The only plugin currently available is a file-finding utility that searches a victim's hard drive for files. By default, NB2 listens on TCP port 20034, but this is easily configurable. NB2 uses a weak form of encryption to obfuscate its communications, but the format of its packets makes it easy to spot NB2 traffic. Each packet starts with 'BN', followed by the following sequence: - - - - Two bytes representing the length of the packet. - - - - Two bytes of 0x02 or 0x00, probably for the version of NetBus. - - - - Two random bytes, probably to confuse people. - - - - Two bytes for the command code. For example: 42 4E XX XX 02 00 YY YY ZZ ZZ ...data... XX XX is the length of the whole NetBus 2.0 packet YY YY are just two random bytes ZZ ZZ is the command code The first 2 bytes are 'BN', the length of the packet is XX XX, and the version is 0x02. NB2 stores registry information in the HKEY_CURRENT_USER\NetBus Server registry key. If you have this key in your registry, NB2 may be running on your machine. To determine the port that NB2 uses, check the value of HKEY_CURRENT_USER\NetBus Server\General\TCPPort, and use the 'netstat -an | find "LISTEN"' command to see if your system is listening on that port. If NB2 is listening, you need to find the NB2 server executable and delete it. The default name is NbSvr.exe, but it can be easily renamed. If NetBus 2.0 is configured to start automatically when your computer boots, the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices registry key will have a registry value called 'NetBus Server Pro' that specifies the full path for the location of the NetBus executable. Use the registry key value to locate and delete the file if you find that NB2 has been installed on your machine without permission. NetBus 2.0 traffic using the default port can be detected by RealSecure if you configure it to monitor traffic on TCP port 20034. Caligula Description: The WM97/Caligula virus was released by 'Codebreakers', a virus exchange (Vx) group. This is a Microsoft Word macro virus that steals your Pretty Good Privacy (PGP) secret key ring and uploads it to a Codebreakers FTP site. When executed, this virus will open the registry and look for the HKEY_CLASSES_ROOT\PGP Encrypted File\shell\open\command registry value. The virus uses this value to find the path to the PGP program. Once it finds the path to PGP, the virus locates your secret key ring, located in the secring.skr file. The virus copies this file to a file called secringXXXX.skr, where each X is an integer from 0 to 7, for example, secring3150.skr. This file is uploaded to an FTP site at 208.201.88.110, or ftp.codebreakers.org, and stored in the incoming directory. After Caligula runs, it sets the registry value HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info\Caligula to 1 (True). You can tell if you have the Caligula virus by looking for that key in the registry. An infection by Caligula can be detected by RealSecure if you configure it to look for FTP connections to 208.201.88.110. Picture.exe Description: The Picture.exe trojan horse program has been circulating around the Internet via an e-mail attachment. If run, this executable will send information about your Windows NT or 95/98 system to any of several e-mail addresses in China. The file has also been seen with the name Manager.exe. Executing or opening Picture.exe places a file called note.exe in your Windows directory. It also adds the line "RUN=NOTE.EXE" to the win.ini file so note.exe runs every time Windows boots. The first time that note.exe runs, it creates a file in your Windows directory called $2321.Dat. This file contains an encoded listing of all of the files whose three-letter file name extensions begin with an h, i, m, p, s, or t. ISS X-Force believes it was the author's intent to get files whose extensions are .idx, .mdb, .pst, .htm, .snm, .pab, and .txt, because those extensions show up in note.exe. However, note.exe will list any file whose extension begins with those letters. Earlier reports indicated that note.exe looks through a user's web cache directories to determine which web sites the user visited, but this claim is false. Note.exe looks through all directories trying to gather e-mail addresses. The data in the file created by note.exe is encoded by adding 5 to each character's ASCII code, for example: C:\Inetpub\iissamples\ISSamples\default.htm becomes: H?aNsjyuzgannxxfruqjxaNXXfruqjxaijkfzqy3myr The second time note.exe runs, it searches all files for e-mail addresses. When it finds an address, it encodes and writes the address to a file called $4135.Dat in your Windows directory. The way that this data is encoded is by subracting 5 from each character's ASCII code, for example: xforce@iss.net becomes: sajm^`;dnn)i`o After note.exe searches all of the files, it overwrites $4135.Dat with compressed data, where every host name is only listed once. It encodes the data by subtracting 5 from each character's ASCII code, and ends each line with ~X or =~X, where X is an integer. The lines that end in ~X are usernames, and the lines that end in =~X are host names. Once decoded, the format of the data looks like this: root~1 xforce~1 support~2 iss.net=~1 microsoft.com=~2 Each username is matched with the corresponding host name. In this example, the e-mail addresses are: root@iss.net, xforce@iss.net, and support@microsoft.com. The third time note.exe runs, it attempts to send the contents of $4135.Dat to any of several e-mail addresses. The addresses ISS X-Force have identified are hongfax@public.szonline.net, chinafax@263.net, hongfax@public.szonline.net, and chinafax1@263.net. The trojan tries to connect to various SMTP servers. ISS X-Force has identified public2.lyptt.ha.cn, public1.sta.net.cn, nenpub.szptt.net.cn, mail.capital-online.com.cn, public2.lyptt.ha.cn, public.cc.jl.cn, pub1.fz.fj.cn, public.szonline.net, and mail.nn.gx.cn. The data is Base64 encoded. A header detected from an e-mail sent by note.exe is as follows: >From: ab To: hongfax@public.szonline.net Subject: A manager software from ZDNet_AU X-Mailer: Microsoft Outlook Express 4.72 Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="====================545354:56:00.PM====" If sending the e-mail succeeds, note.exe will delete $2321.Dat and $4135.Dat. If sending fails, it will try again the next time note.exe runs, and keep trying until it successfully sends the e-mail. Earlier reports also stated that note.exe looks for AOL account information on your computer, because it reads the MAIN.IDX file in your AOL directory. ISS X-Force believes that this statement is false. The program searches the hard drive for .idx files, because it is looking for e-mail addresses, and Microsoft Outlook uses .idx files for keeping track of e-mail in your mail folders. On a machine with AOL 4.0 installed, note.exe does read the MAIN.IDX file in the AOL directory, but the username and password information is never sent to the e-mail addresses in China. Recommendations: It would be difficult to manually search all of your machines to make sure no backdoors are running, so the best way to protect yourself is to not run any untrusted binaries. You should NEVER run any program sent to you over IRC, ICQ, or any other chat medium, as it is quite easy to spoof or impersonate even trusted users, and you can never tell if the person sending you the program is who they claim to be. Don't run any program sent to you via e-mail unless it is digitally signed. It is trivial to fake the sender's address, and you don't know who actually sent the e-mail. Also, be very careful when running programs you download from the Internet or the World Wide Web. Isolating your machines behind a firewall will help prevent attackers from connecting to any backdoors installed on your machine, but it may be possible for them to bypass the firewall if the backdoor is listening on a port that is left open on the firewall, for example, the port DNS uses for its operations. If you find yourself infected with the Picture.exe trojan or the Caligula macro virus, you should run an anti-virus program to get rid of it. For more information: NetBus can be downloaded from http://netbus.nu. ________ Copyright (c) 1999 by Internet Security Systems, Inc. Permission is hereby granted for the electronic redistribution of this Security Alert. It is not to be edited in any way without express consent of the X-Force. If you wish to reprint the whole or any part of this Alert Summary in any other medium excluding electronic medium, please e-mail xforce@iss.net for permission. Internet Security Systems, Inc. (ISS) is the leading provider of adaptive network security monitoring, detection, and response software that protects the security and integrity of enterprise information systems. By dynamically detecting and responding to security vulnerabilities and threats inherent in open systems, ISS's SAFEsuite family of products provide protection across the enterprise, including the Internet, extranets, and internal networks, from attacks, misuse, and security policy violations. ISS has delivered its adaptive network security solutions to organizations worldwide, including firms in the Global 2000, nine of the ten largest U.S. commercial banks, and over 35 governmental agencies. For more information, call ISS at 678-443-6000 or 800-776-2362 or visit the ISS Web site at http://www.iss.net.. Disclaimer The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties with regard to this information. In no event shall the author be liable for any damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk. X-Force PGP Key available at: http://www.iss.net/xforce/sensitive.html as well as on MIT's PGP key server and PGP.com's key server. Please send suggestions, updates, and comments to: X-Force of Internet Security Systems, Inc. -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: noconv iQCVAwUBNs4H8DRfJiV99eG9AQEzLAP/UrxikH1CpUzOr2wKqe3brD60atbvGr0y TEYTi4oFBKAtlg4cDgRlXWA3UGOqzqvB5lc4eEMv1vgKXG0zmFpaPFMpcLP9dtPd e/XDQ/ixESG7MhXHltK8MFJPGyDV3Fz1vwjukUhcqlNmnHqCXcnCnOntjV7zG8Eh dyDGQ1cVA18= =n9in -----END PGP SIGNATURE-----