Security Watch

Blaster worm: A mid-summer's nightmare

It seems the hottest thing this August (apart from the heat-wave in Europe) was a certain Internet worm that spread rapidly and infected thousands of computers within a few hours. But there's no need to panic now as this one doesn't gobble up whole databases.

The worm known as Blaster or MSBlast takes advantage of a vulnerability in a component of Microsoft's operating system that allows people to remotely access certain functions on a computer such as printing and file sharing. Microsoft had warned the public about this hole on 16 July, 2003 and also offered the patch around that time.

Here are a few interesting facts about the Blaster worm:

• Systems won't be infected unless they run operating systems like Windows XP (both 32-bit and 64-bit editions), Windows NT 4.0, Windows 2000, and Windows Server 2003.
• This worm is unique in the sense that it does not spread only through e-mail. Any system (running the above OSes) when connected to the Net can be potentially infected. It has been reported that the worm enters the system through port 135.
• Symantec has determined that MSBlast contains code to launch a Denial-of-Service attack against a Windows update site during a specific time period. Microsoft has retaliated by discontinuing that site and setting up an alternate site.
• MSBlast infected some 1,20,000 computers around the world within 24 hours.

There are certain ways to tell whether a system has been infected by this worm. Typical symptoms may include Windows XP and Windows Server 2003 systems rebooting every few minutes without user input, or Windows NT 4.0 and Windows 2000 systems becoming unresponsive.

In the past year there have been growing concerns about security at Microsoft. The software giant's concerns are evident from the various initiatives it has taken.

Under the link 'Specific Actions for the Blaster worm' Microsoft advises home and corporate users on preventive and removal measures. More information (and other facts about the Blaster worm) are available at: www.microsoft.com/security.

Those who did not download the patch that Microsoft offered can still do so from: www.microsoft.com/downloads OR www.microsoft.com/technet/

And those who just got 'bitten' by the Blaster worm, can get a fix from various anti-virus websites. Symantec for instance is offering a removal tool on its website: www.symantec.com/avcenter.

W32/Welchia Worm

A new worm targeting systems vulnerable to the same vulnerability as W32/Blaster has been reported. This worm, known alternately as 'W32/Welchia', 'W32/Nachi', or 'WORM_MS_BLAST.D', has been reported to: -

• Kill and remove the msblast.exe artifact left behind by W32/Blaster
• Perform ICMP scanning to identify systems to target for exploitation
• Apply the patch from Microsoft described in Microsoft Security Bulletin MS03-026
• Reboot the system

The greatest impact of this worm appears to be the potential for denial-of-service conditions within an organization due to high levels of ICMP traffic.

Sites are encouraged to apply the patch from Microsoft described in Microsoft Security Bulletin MS03-026 and apply network filters as necessary to reduce the impact of this worm.

Sites can find specific information on how to recover a system which has been compromised by W32/Welchia by consulting an anti-virus vendor.

TOP TEN VIRUSES for JULY 2003