massive RPC worm working its way

[spidey07]

Knarly little worm that takes advantage of a MS rpc bug. Make sure you block tcp port 135.

 

[elzmaddy]

I think "Disable NetBIOS over TCP/IP" in Windows would have the same effect wouldn't it?

 

[cleverhandle]

No. RPC is related to NetBIOS, but they're not the same. You need a patch or a firewall. Or both.

 

[MysticLlama]

Yeah, this thing has been annoying the heck out of me the last few days.

I have a set of PCs I'm working on that can't be set up behind the firewall because of IP address conflicts and such, but I finally had to give up and put them behind their own firewall.

It is hitting our IPs here so hard that in the time I could assign an IP address to it and go download the file, I'd get hit with the one that crashes RPC and gives you 60 seconds before it shuts down.

What a PITA.

I also threw up a couple of test boxes to play around with the effects of the different variants (I blocked outgoing traffic on anything but a few ports so as not to add to the chaos). It seems that there are a few floating around that don't actually do anything to the machine (I tried searching for all of the files that the different variants use) but simply just crashes it.

It's amazing to me how many times this has hit our external boxes and how fast it hits a box as soon as it hits the net and yet there seems to be a much smaller than normal about of press for it.

 

[ScottMac]

I'm on via dialup. Cox cable is down in my neighborhood because the wire is so congested.

I called the help desk, because I've logged the addresses that are blabbing on my segment. They took the information, but didn't seem all that interested in it. I figured they could kill the ports on the local switch.

So I shutdown the cable modem and dialed up.

Sucks, but what can ya do ....

FWIW

Scott

 

[Mucman]

We blocked port 135, 139 and 449 (I think that's what it is) a week ago when all those RPC vulnerabilities came out.
We knew for certain that our customers wouldn't patch, and we don't want to deal with the congestion that they will
output.

The more I think about it, the more I think that the Internet is a time bomb waiting to happen. There are way too many
insecure machines out there.

 

[FracturedSoul]

Actually its port 445.

 

[Barnaby W. Füi]

I'm on cable, but thankfully, haven't had any problems. Not even a minor speed hit. 🙂

 

[Macro2]

none of our computers have been breeched thanks to access lists and worm guard...

 

[MIDIman]

This is a really interesting topic. I'm curious if my mom got it last night - she called me and said she was getting a window that would pop up and say "RPC is shutting down your computer" and it would go through a countdown. I remember actually getting this last week, but can't remember if it was Autorooter or LoveSan (a form of Autorooter apparently.

So I shutdown the cable modem and dialed up.

Does this really help any? My mom was on dialup!

Originally posted by: Mucman
We blocked port 135, 139 and 449 (I think that's what it is) a week ago when all those RPC vulnerabilities came out.
Actually its port 445.

So WHAT ports are being attacked exactly? I think its actually all of the above?

ALSO - can WindowsXP's internal firewall block ports, or is that just not possible. I know installing third-party software is better of course, but I'm just curious if MS's firewall its even capable of blocking this port

 

[MIDIman]

Kaspersky is reporting ports 69, 135 and 4444 for LoveSan and

viruslist.com reports port 445 for AutoRooter.

Also - according to TechNet explaining the security patch:

If you are using the Internet Connection Firewall in Windows XP or Windows Server 2003 to protect your Internet connection, it will by default block inbound RPC traffic from the Internet.

 

[jbritt1234]

I got hit with this last night; RPC service terminating and you have 60 seconds to save work before your PC will shutdown. Sucks!

Well, viruses are not my area of expertise, but why don't you all just apply the security patch provided by Microsoft??? After I could finally get the patch downloaded and installed without shutting down, the problems have stopped.

 

[spidey07]

Originally posted by: jbritt1234
I got hit with this last night; RPC service terminating and you have 60 seconds to save work before your PC will shutdown. Sucks!

Well, viruses are not my area of expertise, but why don't you all just apply the security patch provided by Microsoft??? After I could finally get the patch downloaded and installed without shutting down, the problems have stopped.

30,000 pcs is kinda hard to just say "patch me"
🙂

Those times when the patches broke mission critical applications is why large networks don't just roll out a patch without a sh!tload of testing.

 

[chsh1ca]

Originally posted by: spidey07
30,000 pcs is kinda hard to just say "patch me"
🙂
Those times when the patches broke mission critical applications is why large networks don't just roll out a patch without a sh!tload of testing.

Ugh, even 100 machines is tedious for 5 people, I can only imagine how much of a trial 30,000 would be.

 

[err]

well if you have domain policies, you can push out updates or service packs automagically 🙂

however managing 30,000 pcs and ensuring that users know what to do to prevent Internal worm spread is another story.

eRr