Last Updated: 2007-08-21 14:18:33 UTC
by Johannes Ullrich (Version: 4)
Update2: We got a request to explain what will happen if a user clicks on the link. The user will see a web page with one line:
"If you do not see the Secure Login Window please install our Secure Login Applet."
This web page appears to attempt to exploit an older media player (WinAmp) exploit as well as attempting to trick the user into downloading the virus.
As an update to the virustotal result below: Anti malware vendors are rolling out speical updates for this latest version of Storm. I would expect that all the major vendors have one by now, that may actually be useful until the next version is released in a couple days.
Bleedingthreats has a special set of signatures to detect Storm
Update: A reader noted that the binary changes every 30 minutes. Like prior storm versions, we expect that it will justrepack itself.
And a quick warning: Portscanning and excessive downloads from infected machines has lead to rather nasty DDoS attacks in the past. So you may want to watch for that as you investigate.
Headers from the storm web server:
HTTP/1.1 200 OK
Date: Tue, 21 Aug 2007 04:31:54 GMT
They all appear to use the 'nginx' web server. But this is a legit (small / high performance) web server, so a signature based on it may be too generic. If you want to try:
alert tcp any 80 -> $HOME_NET any ( msg: "Storm Worm"; sid: 10001234; content: "|0D 0A|Server|3A| nginx/0.5.17|0D 0A|"; offset: 15; depth: 60;)
Looks like Storm moved to a new mutation. The e-mails are now inviting users to become members in various "clubs". Here is a sample I just got:
Subject: Login Information
Are you ready to have fun at CoolPics.
Account Number: 73422529174753
Your Temp. Login ID: user3559
Temorary Password: jz438
Please Change your login and change your Login Information.
This link will allow you to securely change your login info: http://a.b.c.d/
New Member Technical Support
I have seen about a dozen different once so far. They are all "confirmations" in this style to various web sites. The web page offers again an "applet.exe" for download.
In short: We don't need to enumerate variants of the e-mail message. If you are brave and know what you are doing, download the applet.exe and try to reverse it (not easy typically). Thunderbird warned me that the link is a scam. (I think it does so for all numeric IP links).
My copy of applet.exe was about 114 kB large. While many AV scanners detect it as "evil" based on heuristic signatures, some well known scanners don't (maybe Virustotal is running them without heuristic turned on, or they just don't do it)
IMHO: this is a lost cause. People are either infected or they know how to protect themselves.
File applet.exe received on 08.21.2007 05:21:50 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
|Authentium||4.93.8||2007.08.20||Possibly a new variant of W32/Fathom.2-based!Maximus|
|CAT-QuickHeal||9.00||2007.08.20||(Suspicious) - DNAScan|
|File size: 114623 bytes|
|Sunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics.|
(I replaced the numeric IP address with 'a.b.c.d')
Last Updated: 2007-08-21 14:04:18 UTC
by Johannes Ullrich (Version: 1)
Across the world, copper prices have increased substantially over the last couple years. As a result, theft of copper has been on the increase. In my area, multiple houses and business got stripped of their air conditioners, and in some cases (mostly construction sites), copper wire was stipped out of the building and large spools where removed from the properties.
Having your AC stolen can be a huge disaster for a data center. Most of the time, the copper (or even aluminium) heat exchanger is outside of the building and not well secured. The usual recommendation is to build a "cage" around the device which still allows for sufficient air circulation. Monitoring the temperature in your data center (or server closet) is a good idea as well. Many alarm systems and alarm companies will be able to monitor it for you and alert you if it exceeds a given range.
One reader (Scott) noted that a number of transmission towers they owned got vandalized by copper thieves. In his case, old microwave guides got stolen from the towers. Needless to say, it is not easy to monitor remote locations like towers.
Michael wrote in to share a story about a major disruption of a german rail line a while ago due to stolen cable.
Last Updated: 2007-08-21 12:44:58 UTC
by Johannes Ullrich (Version: 1)
As hurricane Dean intensified, we did see a number of related domain registrations. At this point, we are not aware of any of them being used fraudulently. If you come across one, let us know. There is very little infrastructure in the affected area, so we expect minimal impact beyond the directly affected area.
See our prior "disaster preparedness" diaries on tips how to prepare for this kind of event.