ENSRT Incident Note ETS-i-2005-12514
The Enterasys Networks Security Response Team (ENSRT) publishes incident notes to provide information for our constituents to raise awareness of issues deemed threatening to the security and integrity of our customers.
Worm - Backdoor.Sdbot.AI
Release Date: 01/04/2005
Last Updated:
Overview
Backdoor.Sdbot.AI spreads via network shares. If successful, the worm will compromise security settings by opening a backdoor listener via an IRC connection.
Systems affected
Windows operating systemsSystems not affected
Linux and MAC/OSXDescription
When Backdoor.Sdbot.AI is executed, it attempts to copy the file %System%\systca.exe to remote network shares C$, IPC$ and ADMIN$ using user names obtained through the NetUserEnum API and a pre-determined list of passwords.
After it is sucessfully executed, the worm connects to an IRC server on the domain "bob.nsns.biz", through TCP port 29147.
Note: TCP port 29147 is an unregistered port and domain "bob.nsns.biz" currently resolves to IP address 208.53.170.123
Once the conquered system is connected to the IRC server, it listens for commands from a remote attacker. The list of possible actions that the attacker can perform include:
Perform a Denial of Service (DoS) attack against a target host
Connect to a URL
Upload and download files
Execute programs
Conduct port scans
Threat Assessment
Trojans or backdoor listeners if not addressed through prudent remediation steps, can compromise network and host security. Additionally, trojans and backdoor listeners potentially allow theft of information, unauthorized remote access, and damage to critical files.
Remediation
| Matrix N7 | X |
| Matrix E7 | X |
| Matrix E6 | X |
| Matrix E5 | X |
| Matrix E1 | X |
| VH | X |
Detection
Updated IDS signatures can be downloaded here: https://dragon.enterasys.com (requires login)
Prevention
Trusted End System solutions are capable of monitoring various end system activity. TES is able to take immediate action such as firewalling specific IPs, TCP/UDP ports, applications, or placing the user into a Quarantine policy or VLAN until end system threat is mitigated. Learn more at: http://www.enterasys.com/solutions/secure-networks/trusted_end_system/
Containment
Internet or edge facing firewalls should be configured with a default 'Deny' policy and contain 'Permit' policies for only needed services and applications. Furthermore, careful inspection of firewall policies that allow TCP traffic streams to be initiated from the Internet into internal enterprise resources is required. These policies should only allow specific protocols to trusted servers thereby combating the increased use of random TCP ports by Internet Trojans and worms.
Apply the below available NetSight PMD file and apply the policy to user ports to block the Backdoor.Sdbot.AI worm
This NetSight PMD file can be downloaded from here: http://www.enterasys.com/support/pmd.html?12514
Repair
Scan all clients and servers for newly opened TCP ports that did not appear in previous TCP scans. If viruses are detected apply appropriate removal tools on each client and server that have the open ports (See your anti-virus solution for removal instructions).
Monitor SMTP mail server logs to locate infected users sending multiple copies of the worm e-mail matching the previously defined subject and body. Once isolated, see your anti-virus vendor for Windows repair procedures for infected users.
References
http://www.iana.org/assignments/port-numbers
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.sdbot.ai.html
This document and the information contained herein are intended solely for informational use. Enterasys Networks, Inc. makes no representations or warranties of any kind, whether expressed or implied, with respect to this information and assumes no responsibility for its accuracy or completeness. Enterasys Networks, Inc. hereby disclaims all liability and warranty for any information contained herein and all the material and information herein exists to be used only on an "as is" basis. More specific information may be available on request. By your review and/or use of the information contained herein, you expressly release Enterasys from any and all liability related in any way to this information.
A copy of the text of this section is an uncontrolled copy, and may lack important information or contain factual errors. All information herein is Copyright ©Enterasys Networks, Inc. All rights reserved. All information above is subject to change without notice.
Revision History:
|
Version: 1.0 |
Date: 01/04/2005 |
Author: ENSRT STAFF |
Change |