Microsoft DCOM RPC Worm

[vsantana]

Has Cisco deployed or will deploy soon an IDS signature to detect this worm?

[HEATH FREEL]

Yes - IDS-sig-3.1-3-S49.bin is the one for version 3.1 of the sensor - but I cant get it installed properly.

[mcerha]

Yes, signatures 3327 and 3328 in signature update S49 will catch the buffer overflow attack used by the worm. Due to false positives, signature 3327 should be tuned to just inspect traffic on port 135, not ports 139 or 445. In addtion, you can add a custom signature to catch a host infected by the atempting to request a copy of worm payload file using TFTP. Here are the necessary parameters:

Engine STRING.UDP

SigName MS Blast Worm TFTP Request

ServicePorts 69

RegexString \x00\x01[Mm][Ss][Bb][Ll][Aa][Ss][Tt][.][Ee][Xx][Ee]\x00

Direction ToService

[bwheeler]

I have updated our IDS to signature update S49, and added the custom signature that you suggested. I know that there are infected computers on our network, but nothing shows up. Any ideas ?

[klwiley]

Whether or not your sensor will see this worm on your network depends on the positioning of your sensor due to the nature of the way the worm spreads. It limits most of it's scanning activity to the local network segment of the infected host. If your sensor is positioned such that only inter-network communication is seen and it can not see intra-network communication you will probably not see many if any alarms.

[d.twaddle]

Here are a few more custom signatures, including the one posted above, to detect variants.

Engine STRING.UDP

SigName MS Blast Worm TFTP Request

ServicePorts 69

RegexString \x00\x01[Mm][Ss][Bb][Ll][Aa][Ss][Tt][.][Ee][Xx][Ee]\x00

Direction ToService

Engine STRING.UDP

SigName MS Blast Worm B TFTP Request penis32.exe

ServicePorts 69

RegexString \x00\x01[Pp][Ee][Nn][Ii][Ss][3][2][.][Ee][Xx][Ee]\x00

Direction ToService

Engine STRING.UDP

SigName MS Blast Worm C TFTP Request teekids.exe

ServicePorts 69

RegexString \x00\x01[Tt][Ee][Ee][Kk][Ii][Dd][Ss][.][Ee][Xx][Ee]\x00

Direction ToService

Engine STRING.UDP

SigName MS Blast Worm TFTP Request smsx.exe

ServicePorts 69

RegexString \x00\x01[Ss][Mm][Ss][Xx][.][Ee][Xx][Ee]\x00

Direction ToService