[ale] TCP port 1433 attacks (MS SQL)

Wed May 22 09:01:34 EDT 2002

This from ISS:
Internet Security Systems Security Alert
May 21, 2002

Microsoft SQL Spida Worm Propagation

Synopsis:

ISS X-Force has learned of a worm that is spreading via Microsoft SQL
servers. The Spida worm is responsible for large amounts of Internet
traffic as well as millions of TCP/IP probes at the time of this alert's
publication. This worm attempts to locate and login to MS/SQL servers
with the "sa" account and a blank password. Once a vulnerable computer
is found, the worm will infect that target, send its configuration and
password information to an external host, and begin scanning for new
targets.

Impact:

Although the Spida worm is not destructive to the infected host, it may
generate a damaging level of network traffic when it scans for
additional targets. The scanner bundled with the worm is multi-threaded
and is capable of scanning with 100 threads. A large amount of network
traffic is created by the worm, which scans both internal and external
IP addresses for vulnerable servers.

Description:

The Spida worm propagates via Microsoft SQL installations with
administrator accounts that have no passwords defined. Although
Microsoft recommends that the "sa" account be set upon installation,
many servers are not properly secured. If the worm finds a vulnerable
server, it will attempt to execute its startup script by running the
"xp_cmdshell" function, which is the SQL call used to execute system
commands within SQL queries.

The main function of the Spida worm is to export an infected server's
SAM password database and forward information about its network and
database configuration.

The worm installs all of its files into the \Windows\system32 directory
except for services.exe, which is installed into the
\Windows\system32\drivers directory. Each of these files has a distinct
function which is outlined below:

sqlprocess.js - This is the worm's main payload. It holds IP address
arrays which are later used in the services.exe scanner. It executes
"ipconfig /all" and appends this information to send.txt. This script
then runs sqldir.js and appends all of the server's database information
to send.txt. It then executes pwdump2 and appends the password hashes to
send.txt, then runs clemail.exe and mails send.txt to ixltd at postone.com.
After the email is sent, send.txt is destroyed and services.exe is run
to scan for other vulnerable servers. This information is appended to
rdata.txt, which the worm uses to attempt to propagate with the username
"sa" and a null password. The sqlprocess.js file sets the registry value
dbmssocn to configure the SQL server to use the Winsock TCP/IP library
instead of the default DBNETLIB library:
(HKLM\\software\\microsoft\\mssqlserver\\client\\connectto\\dsquery).
It also turns on the NetDDE service, allowing SQL to use the DDE
protocol.

sqlexec.js - This is a script used by sqlprocess.js to execute
xp_cmdshell. sqlinstall.bat is run within this instance of xp_cmdshell.

sqldir.js - Collects a list of databases on the infected system. Later,
sqlprocess.js writes this information in send.txt to send to
ixltd at postone.com.

run.js - This script passes time information to and from timer.dll.

sqlinstall.bat - Installs the worm then hides the files.

clemail.exe - Simple mail program used to email out the send.txt file.

services.exe - Scanner used by the worm to scan for other SQL servers on
port 1433. This information is appended into the rdata.txt file. This
file is multi-threaded and scans internal IP addresses before performing
an external IP address sweep.

pwdump2.exe - Injects samdump.dll into lsass.exe (a Windows program that
performs the authentication of log-on credentials) in order to grab raw
NTpassword hashes.

samdump.dll - Uses the same API that msv1_0.dll uses to capture Windows
password hashes.

timer.dll - A counter used for installation and other functionality of
the worm.

Recommendations:

Microsoft SQL Server customers should refer to the following address for
information and securing Microsoft SQL Server:
http://www.microsoft.com/sql/techinfo/administration/2000/security.asp.

ISS Database Scanner product implemented a check for a blank
administrator password in December of 1998. Database Scanner customers
are encouraged to enable this check if they have not done so. For more
information, refer to:
http://www.iss.net/products_services/enterprise_protection/vulnerability
_assessment/scanner_database.php

ISS RealSecure Network Sensor customers may use the following connection
event to detect access attempts to the SQL Server port. Follow the
instructions below to apply the connection event to your policy. This
connection event will detect legitimate connection attempts to MS/SQL
servers.
1. Choose a policy you want to use, and click Customize.
2. Select the Connection Events tab.
3. Click Add on the right hand side of the dialog box.
4. Create a Connection Event.
5. Type in a name of the event, such as "MS/SQL Port Probe".
6. In the Response field for the event, select the responses you want to
use.
In the Protocol field, select TCP.
In the Dest Port/Type field click the pull down box and create an entry
for TCP port 1433:
a. Click Add.
b. Select TCP Protocol.
c .Name the service "MS/SQL Port Probe".
d. Use 1433 for the port number.
e. Click OK.
f. Select the entry just created.
7. Save changes and close the window.
8. Click Apply to Sensor or Apply to Engine depending on the version of
RealSecure.

To create a user-defined event RealSecure Server Sensor:
1. Open the desired policy.
2. Expand the Connections tree on the Protect view.
3. Expand the User Defined Suspect Connections branch.
4. Click Add to add a new User Defined Suspect Connections event
5. Name the event, SQL_Connection.
6. Select the desired responses under the response column.
7. Enter "1433" under the port column.
8. Save the Policy and apply it to the sensor.

ISS BlackICE customers should monitor and/or enable the "SQL Port Probe"
event. This event will detect probes by the Spida worm.

ISS X-Force will provide assessment support for this vulnerability in an
upcoming X-Press Update for Internet Scanner.

______

About Internet Security Systems (ISS)
Founded in 1994, Internet Security Systems (ISS) (Nasdaq: ISSX) is a
pioneer and world leader in software and services that protect critical
online resources from an ever-changing spectrum of threats and misuse.
Internet Security Systems is headquartered in Atlanta, GA, with
additional operations throughout the Americas, Asia, Australia, Europe
and the Middle East.

Permission is hereby granted for the electronic redistribution of this
document. It is not to be edited or altered in any way without the
express written consent of the Internet Security Systems X-Force. If you
wish to reprint the whole or any part of this document in any other
medium excluding electronic media, please email xforce at iss.net for
permission.

Disclaimer: The information within this paper may change without notice.
Use of this information constitutes acceptance for use in an AS IS
condition. There are NO warranties, implied or otherwise, with regard to
this information or its use. Any use of this information is at the
user's risk. In no event shall the author/distributor (Internet Security
Systems X-Force) be held liable for any damages whatsoever arising out
of or in connection with the use or spread of this information.

X-Force PGP Key available on MIT's PGP key server and PGP.com's key
server, as well as at http://www.iss.net/security_center/sensitive.php

Please send suggestions, updates, and comments to: X-Force
xforce at iss.net of Internet Security Systems, Inc.
\_\_\_\_\_\_\_\_\_\_\_/_/_/_/_/_/_/_/_/_/_/
\_    Steve Angell,  MCSE, CCNA           _/
\_    MIS Operations Manager               _/
\_    TSYS Debt Management             _/
\_    Norcross, GA                                   _/
\_    Phone 770-409-5570                    _/
\_    Fax      770-416-1752                   _/
\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/

                    Transam                                                                                        
                    <transam at cavu.       To:     ale at ale.org                                                       
                    com>                 cc:                                                                       
                                         Subject:     [ale] TCP port 1433 attacks (MS SQL)                         
                    05/22/2002                                                                                     
                    06:55 AM                                                                                       

In the past 24 hours there has been a tremendous increase in attacks to
TCP port 1433 (Microsoft's SQL server).  In at least some of these, the
attacker is checking for an allowed login with the default account name
of "sa" and an empty password.  Unless your Firewall is blocking this you
are at risk.

There is more information at

http://Security.ITtoolbox.com/browse.asp?c=SecurityNews&r=/news/dispnews.asp?i=72558

Best regards,

Bob Toxen
book at cavu.com
http://www.realworldlinuxsecurity.com/ [My 5* book: Real World Linux
Security]
http://www.verysecurelinux.com      [Linux/Unix & Network Security
Consulting]

Fly-By-Day Consulting, Inc.      "Don't go with a fly-by-night outfit!"
Quality Linux & UNIX security and software consulting since 1990.

---
This message has been sent through the ALE general discussion list.
See http://www.ale.org/mailing-lists.shtml for more info. Problems should
be
sent to listmaster at ale dot org.

---
This message has been sent through the ALE general discussion list.
See http://www.ale.org/mailing-lists.shtml for more info. Problems should be
sent to listmaster at ale dot org.