==== Computer Virus Catalog 1.2: AT&T Attack Virus (31-January-1992) === Entry...............: AT&T Attack Virus Alias(es)...........: --- Virus Strain........: --- Virus detected when.: 1988 where.: AT&T Bell Labs, USA Classification......: (Bourne-) Shellscript Virus, direct action, prefix Length of Virus.....: 634 Bytes in 24 lines --------------------- Preconditions ------------------------------------ Operating System(s).: UNIX Version/Release.....: Any version Computer model(s)...: Any model --------------------- Attributes --------------------------------------- Easy Identification.: Virus resides in the beginning of a shell-script. The end of the viral part of the script is marked with "# mark". Type of infection...: The virus is executed as a background process. All outputs are redirected to /dev/null. It infects all shell-scripts in the directories described below (see: media). A shell-script must start with "#!/bin/sh". Shell-scripts are only infected once. The virus and the uninfected script are concatenated in the /tmp-directory and then copied to replace the original script. Infection Trigger...: Executing an infected shell-script. Media affected......: Filesystem-directories: /bin, /usr/bin, /u*/*/bin and the currently active directory. Damage..............: Virus copies shell /bin/sh with superuser-status to a special file in the /tmp-directory, gives access to all users and sets SUID-bit. Anyone executing this file gains superuser- status. Virus sends a mail, that the security hole is created. Damage Trigger......: Running an infected script by 'root'. Particularities.....: 1) A UNIX Security specialist at AT&T Bell Labs created this virus for experiments, and he deliberately "attacked" (his own words) several systems at the AT&T Lab. He pre- sented details of this virus at several conferences and in other publications. From his contributions (and those of a colleague who published additional details), there is no evidence that the users of deliberately attacked systems had been warned to care for possible unforeseen side-effects. (compare also the Shoch-Hupp WORM experi- ments at Xerox PARC, published in 1982). 2) Variations (length, identification, damage, directories affected, etc.) rather easy. Similarities........: --- --------------------- Agents ------------------------------------------- Countermeasures.....: Check for SUID files Countermeasures successful: Standard means......: Files without write permission cannot become in- fected; even the owner can save his/her files by forbiding him/herself write-access. Root must be very careful with any shell-script. --------------------- Acknowledgement ---------------------------------- Location............: Virus Test Center, University Hamburg, Germany Classification......: Uwe Ellermann Documentation by....: Uwe Ellermann Date................: 23-August-1991 Update..............: 31-January-1992 Information Source..: Conference reports; analysis of an event at ETH Zuerich ===================== End of AT&T Attack - Virus ======================= ======= Computer Virus Catalog 1.2: INTERNET Worm (31-July-1993) ======= Entry...............: INTERNET Worm Alias(es)...........: --- (Remark: wrongly named INTERNET Virus) Worm Strain.........: --- Worm detected when..: 2-November-1988 where.: Cornell University and more than 2,000-6,000 BSD-UNIX systems in USA (few outside) heavily affected (temporarily taken from net) Classification......: Worm distributed on UNIX systems (BSD versions on VAX, SunOS) connected to INTERNET, attacking legal user accounts Length of Worm......: About 3200 lines of C-code --------------------- Preconditions ------------------------------------ Operating System(s).: BSD-derived versions of UNIX (SunOS, Ultrix) Version/Release.....: --- Computer model(s)...: Sun systems, VAX systems --------------------- Attributes --------------------------------------- Easy Identification.: Unusual files in /usr/tmp directory, and unusual messages appear in special log files such as SENDMAIL handling agent. Infected systems become heavily loaded with running processes. Type of infection...: After locating a host which can be infected, the following steps are performed: (1) Check that host is not the local host, and that it has not been marked as immune or infected, and that it's address can be located. If no address is found, it is marked as immune in a list. (2) Check for other worms, waiting one second. (3) Try to infect host using "rsh". This attack will succeed when remote machine has a "hosts.equiv" file or user has a ".rhosts" file that allows remote execution without password. If successfull, worm copies vector program to the remote machine. (4) If that fails, try using "sendmail". Worm uses debug option of "sendmail", which enables debugging mode during connection. In debugging mode, it is possible to mail a message directly to a process which then creates another process, thereby inheriting fingerd privileges. Worm tries to send vector program to the shell which runs it. (5) If that fails, try using "fingerd". Worm sends a string of 536 bytes to finger daemon, causing stack overwrite on VAX systems due to a bug. Worm modifies return address, and upon return executes the shell. (6) Upon successfull infection, the vector program is installed on the remote machine and compiled under the name "sh". If worm runs on a host, it looks like the shell "sh" to those running "ps". (7) Once connected to a host, worm attempts to break user accounts from /etc/passwd file by guessing obvious passwords, such as user name or none at all, then by comparing the password against a 432 word dictionary and the dictionary in /usr/dict/words. Infection Trigger...: The local host is infected if worm connects from a remote system (see: Type of Infection) and manages to crack one user account on the local host or exploits some security hole of local host's operating system. Storage media affected: Filesystem directory: /usr/tmp Interrupts hooked...: --- Damage..............: Although the worm does not attempt to destroy any data or to transmit any information from infected systems to other sites, a cracked user account could be called a damage as well. Transient damage: worm activities add significant load (demand for storage and CPU) to attacked system and network nodes. Damage Trigger......: --- Particularities.....: 1) Worm is created on one system by copying from another system, making use of flaws in utility programs (rexec/rsh, finger, sendmail). 2) Worm tries to hide itself by changing its command line vectors, so that it looks like Bourne-Shell "sh" when running "ps" command. 3) Each of the binary files is read into memory, where it is encrypted (simply by XORing), and the original files are deleted from filesystem. 4) Worm forks itself, splitting into a parent and a child, nearly every three minutes. Then, parent process is killed so that neither pro- cess can be noticed as an excessive CPU user. 5) Worm checks for other worms, as a part of a mechanism to prevent over-infection of a particular host. This control facility fails, due to a programming error. If worm runs for more than 12 hours, it tries to reinfect hosts which may have been cleaned of their infection. 6) Worm author was located in Cornell university. He was subsequently suspended for some time from his university, and a New York State Court convicted him; punishment: 10,000$ and 400 hours of social work. Similarities........: --- --------------------- Agents ------------------------------------------ Countermeasures.....: The bugs that the worm exploited were meanwhile fixed so that the original worm may no longer work. Generally, possible attempts to stop this worm may be: (1) Patching out debug command in sendmail (rather than completly turning off mail service). (2) Shutting down the finger daemon or fixing the finger daemon required source code. (3) Requesting new passwords for all users who had passwords which worm could guess. (4) Creating a directory /usr/tmp/sh: delete command used by worm (rm -f) doesn't remove directories so that this delete and the creation of file "sh" fail. (5) Setting the global variable "pleasequit" which worm checks. (6) Drastic measure: renaming C compiler/linker. (7) Very drastic measure: Isolating an infected host from the network. Countermeasures successful: After this worm's attack on several thousand VAX or SUN systems, experts at several US centers developped means to stop worm propagation and clean infected systems. Standard means......: --- --------------------- Acknowledgement --------------------------------- Location............: Virus Test Center, University of Hamburg, Germany Classification by...: Stefan Kelm, Wolfram Schmidt Documentation by....: Stefan Kelm, Wolfram Schmidt Date................: 31-July-1993 Information Source..: (1) Eugene H. Spafford: "The Internet Worm Program: An Analysis", Purdue Technical Report CSD-TR-823, November 1988 (2) Mark W. Eichin, Jon A. Rochlis: "With Microscope and Tweezers: An Analysis of the Internet Virus of November 1988", Massachusetts Institute of Technology, February 1989 (3) David Ferbrache, Gavin Shearer: "UNIX installation security and integrity", Blackwall Scientific Publications, 1992, pp 241-248 ===================== End of INTERNET Worm ============================= ====== Computer Virus Catalog (1.2): VMAGIC Virus (31-July-1993) ======= Entry...............: VMAGIC Virus Aliases.............: --- Virus detected when.: 1993 where.: Publication of C-Code Classification......: Program virus, COFF infector only Length of Virus.....: 1a.Length pure code: 158 Bytes (effective length may depend on operating system and C compiler version/optimization) 1b.Length Maincode (incl. header): 798 Bytes 2. Length Search program "searcher": 43832 Bytes 3. Length Infect program "infect": 51032 Bytes 4. Length Script Infect1: 1428 Bytes 5. Length Script Infect2: 18 Bytes --------------------- Preconditions ------------------------------------ Operating System(s).: UNIX Version/Release.....: --- Computer model(s)...: All, but virus code must be modified for INTEL Processors --------------------- Attributes --------------------------------------- Easy Identification.: --- Type of infection...: 1) Infected file = Maincode is merged into text area of host program. 2) Mechanism: Starting an infected file will call an external program "searcher" to find un- infected executable files for infection. Such a filename is passed as an argument to the external program "infect" which will call two scripts with link commands (infect1, infect2) both combined as "linker script" to merge target file with virus' main code. Self Identification.: The string "0x75E0" will be found in the Auxiliary File Header Version Stamp; this is the value associated to external variable VMAGIC. Infection Trigger...: Execution of an infected file, when last infection is older than 24 hours. Storage media affected: All directories with write access. Damage..............: No intentional permanent/transient damage found. (Not tested for side effects) Particularities.....: 1) The virus runs only on one host. It does NOT distribute itself over networks. 2) Virus creates a file "searcher" in a hidden directory "/usr/.hidden". "searcher" looks for executable files to be infected and executes "infect". 3) To "install" the virus on one host, it is neccessary to have virus main code, search program, infect program and linker script. The infect program can be placed anywhere. 4) Virus creates a temporary lockfile "..." in directory "/tmp". The date of last infection is stored in this file. 5) The virus as published will run on System V.2 on 68000 (Mac etc) only; these systems have 3 segments (.text, .data, .bss). Other versions and hardware platforms need more (specialised) segments not specified in published virus. Infectivity.........: As this virus can infect only COFF files (files including debug information) which are mainly used for development rather than normal operation (such files are usually stripped of information), the probability of an infection during normal operation is low. --------------------- Agents ------------------------------------------- Countermeasures.....: --- --------------------- Acknowledgement ---------------------------------- Location............: Virus Test Center, University Hamburg, Germany Classification by...: Andreas Mueller, Wolfram Schmidt Documentation by....: Andreas Mueller, Wolfram Schmidt Date................: 31-July-1993 Information source..: Analysis of virus code (published in C) ===================== End of VMAGIC ==================================== === Computer Virus Catalog 1.2: CHRISTMA Chain Letter (31-July-1993) === Entry...............: CHRISTMA Chain Letter Alias(es)...........: CHRISTMA.EXEC (G1/G2) Chain Letter Malware Strain......: CHRISTMA.EXEC Chain Letter Malware detected when.: 1st generation (G1) December 9, 1987 where.: Spreading from University Clausthal-Zellerfeld, North Germany via BITNET into office mail systems (industry,research,universities) worldwide 2nd generation (G2): Re-Released December 5, 1988 Classification......: Chain Letter, written in Control Language "REXX" (interpreted, not compiled) Length of Malware...: REXX Code: about 102 lines/3 kBytes --------------------- Preconditions ------------------------------------ Operating System(s).: IBM mainframe VM/CMS Version/Release.....: -- Computer model(s)...: IBM mainframes: /370, 3080/3090, ES8900, ES9000 --------------------- Attributes ------------------------------------- Easy Identification.: The following text is placed at the start of the REXX program CHRISTMA.EXEC: Text #1: "/*********************/ /* LET THIS EXEC */ /* */ /* RUN */ /* */ /* AND */ /* */ /* ENJOY */ /* */ /* YOURSELF! */ /*********************/" Text #2: "SAY ' * ' SAY ' * ' SAY ' **** ' SAY ' ******** ' SAY ' ************ ' SAY ' **************** A' SAY ' ******** ' SAY ' ************ VERY' SAY ' **************** ' SAY ' ******************** HAPPY' SAY ' *********** ' SAY ' *************** CHRISTMAS' SAY ' ******************* ' SAY ' *********************** AND MY' SAY ' *************** ' SAY ' ******************* BEST WHISHES' SAY ' *********************** ' SAY ' *************************** FOR THE NEXT' SAY ' ****** ' SAY ' ****** YEAR' SAY ' ****** ' /* browsing this file is no fun at all just type CHRISTMAS from cms */" Type of infection...: Copying file to another user within network (not RELAY). Infection Trigger...: Execution of CHRISMA.EXEC in January and December of years before 1989. Storage media affected: Files which were sent to someone are stored in the reader of the recipient. Interrupts hooked...: -- Damage..............: Permanent Damage: No intended damage of data or programs. Transient Damage: 1) A "welcome" text and achristmas tree is displayed on screen (see Easy Identifica- tion: text #1/#2). 2) File CHRISTMA.EXEC is sent to all addresses found in NAMES file and to those found in NETLOG file with the action "SENT", where it is stored in recipient's reader. 3) System overload: as Christma.EXEC propagated rather fast, it made heavy use of memory, CPU and disk storage, thereby significantly degrading the attacked system's performance. Damage Trigger......: Execution of Program CHRISTMA.EXEC in January and December of years before 1989. Particularities.....: 1) CHRISTMA.EXEC generation 1 (basis of this ana- lysis) did not delete itself after execution. In international discussions, a 2nd generation of CHRISTMA.EXEC was described which deletes itself after execution. 2) As several network attacks on other system plat- forms (though not all), this attack was written in a high level interpretative system language (REXX). Similarities........: Based on the methods of CHRISTMA.EXEC, a signifi- cantly changed Chain Letter ZEBRATEL.EXEC was detected, in winter 1992/1993, in Greece but was not reported to spread widely. --------------------- Agents ------------------------------------------- Countermeasures/ proper successful.: Filtering software in IBM network nodes (VNET) detect name string "CHRISTMA.EXEC" in data area of transfer protocol. Moreover, VNET fil- ters generally invert suffixes EXEC to CEXE; therefore, a chainletter attack will only be successful if some user changes file extension back into EXEC and executes such file, without prior analysis. Standard means......: Browse incoming file --------------------- Acknowledgement ---------------------------------- Location............: Virus Test Center, University Hamburg, Germany Classification by...: Wolfram Schmidt, Klaus Brunnstein Documentation by....: Wolfram Schmidt, Klaus Brunnstein Date................: 31-July-1993 Information Source..: Reverse-Analysis of REXX code ===================== End of CHRISTMA.EXEC Chain Letter ================