Linux/Slapper-A

Name: Linux/Slapper-A
Type: Linux worm
Date: 14 September 2002


At the time of writing Sophos has received no reports from users
affected by this worm. However, we have issued this advisory
following enquiries to our support department from customers.

Description
Linux/Slapper-A is a worm which tries to exploit a buffer overflow vulnerability in the OpenSSL component of SSL-enabled Apache web servers. Once active, the worm can be used as a backdoor to start up a range of denial-of-service attacks.

Linux/Slapper-A spreads between systems via TCP port 443 (SSL). Before connecting to this port, the worm connects to TCP port 80 (HTTP) in order to try to customise its attack for specific Apache versions. If a web server other than Apache (or which identifies itself as other than Apache) is found, the worm will not attempt to infect.

The worm looks for:

Red Hat running Apache 1.3.6, 1.3.9, 1.3.12, 1.3.19, 1.3.20, 1.3.22, 1.3.23 and 1.3.26.

SuSE running Apache 1.3.12, 1.3.17, 1.3.19, 1.3.20, 1.3.23.

Mandrake running Apache 1.3.14, 1.3.19, 1.3.20, 1.3.23.

Slackware running Apache 1.3.26.

Debian running Apache 1.3.26.

Gentoo running any version of Apache.

If the system distribution or Apache version cannot be determined, the worm assumes Red Hat running Apache 1.3.23.

Linux/Slapper-A connects via TCP port 443 (SSL) and tries to launch a shell (/bin/sh) on the remote system by exploiting a buffer overflow. The flaw in OpenSSL which allows Linux/Slapper-A to spread was announced and fixed in an OpenSSL Security Advisory of 30 July 2002.

If Linux/Slapper-A successfully breaks into its victim, the worm injects a shell script into the remote shell it has launched. The shell script contains a uuencoded copy of the worm's own source code. The script decodes this source code into the file /tmp/.bugtraq.c, compiles it using gcc into the executable file /tmp/.bugtraq and then executes it. A daemon process called .bugtraq will be visible on infected computers.

Note that the Linux/Slapper-A worm depends on the presence of the gcc compiler on victim computers, and also requires that the compiler be executable by the Apache user. Sophos recommends removing, or limiting access to, the compiler on production web servers.

Once active, Linux/Slapper-A opens up a backdoor which can be contacted via UDP port 2002. The backdoor is intended to allow a range of attacks to be initiated from infected computers, such as: executing arbitrary commands; creating TCP floods; creating DNS floods and searching for email addresses on disk.



Recovery
Please read the instructions for removing worms.
Search for and kill any running processes named .bugtraq.



More information about Linux/Slapper-A can be found at
http://www.sophos.com/virusinfo/analyses/linuxslappera.html

 

WOW!
The sky really is falling.
Makes ya wonder where all this is going huh? These guys just keep getting nastier and nastier.

 

One wonders with all that creativity and knowledeability why they don't build a nice secure new OS for the world and make real money replacing windows.
Windows has it's name from all those peeping holes probably; else it had been bunker or such a name.

 

I was waiting for you all make a thread also then though it would be a good idea to link here since DSLR just picked it up. This could be a nasty.

http://www.dslreports.com/forum/remark,4438647~root=security,1~mode=flat

 

The link to Symantec about this one:

http://securityresponse.symantec.com/avcenter/security/Content/2002.09.13.html

 

Global Slapper Worm Information Center

Updated: Monday 23rd of September, 08:20 GMT


NEWS UPDATE ON SLAPPER VARIANTS
Two new variants of Slapper, "Cinik" and "Unlock" have been found over the weekend.

For more information, see the virus description.

As both Cinik and Unlock versions use the same vulnerability as the original Slapper worm, most of the potential targets for them have been updated and patched already to prevent infection.
http://www.f-secure.com/slapper/

______________________________________
A new variant of Slapper known as "Cinik" was found on Monday the 23rd of September 2002.

This is slightly modified variant of Slapper.A. It uses port 1978 instead of port 2002 and the filename of the worm has been changed to "cinik.c".


__________________________________________

Another variant "Unlock" was found on Sunday the 22nd of September 2002.

This variant uses port 4156 instead of port 2002 and the filename of the worm has been changed to "unlock.c".

 

A suspect has been arrested on suspicion of authoring the Slapper worm.
But although the threat of the worm seems to have been shortlived, a new variant is already set to take up where its predecessor left off...

more: http://www.vnunet.com/News/1135274


Technodrome

 

Re:Linux/Slapper-B

Name: Linux/Slapper-B
Aliases: Worm.Linux.Slapper, Linux/Slapper.worm
Type: Linux worm
Date: 24 September 2002


At the time of writing Sophos has received no reports from users
affected by this worm. However, we have issued this advisory
following enquiries to our support department from customers.

Note: This IDE file contains detection for both Linux/Slapper-B
and Linux/Slapper-C.

Description
Linux/Slapper-B is a variant of Linux/Slapper-A and is a worm which tries to exploit a buffer overflow vulnerability in the OpenSSL component of SSL-enabled Apache web servers. Once active, the worm can be used as a backdoor to start up a range of denial-of-service attacks.

Linux/Slapper-B spreads between systems via TCP port 443 (SSL). Before connecting to this port, the worm connects to TCP port 80 (HTTP) in order to try to customise its attack for specific Apache versions. If a web server other than Apache (or which identifies itself as other than Apache) is found, the worm will not attempt to infect.

The worm looks for:

Red Hat running Apache 1.3.6, 1.3.9, 1.3.12, 1.3.19, 1.3.20, 1.3.22, 1.3.23 and 1.3.26.

SuSE running Apache 1.3.12, 1.3.17, 1.3.19, 1.3.20, 1.3.23.

Mandrake running Apache 1.3.14, 1.3.19, 1.3.20, 1.3.23.

Slackware running Apache 1.3.26.

Debian running Apache 1.3.26.

Gentoo running any version of Apache.

If the system distribution or Apache version cannot be determined, the worm assumes Red Hat running Apache 1.3.23.

Linux/Slapper-B connects via TCP port 443 (SSL) and tries to launch a shell (/bin/sh) on the remote system by exploiting a buffer overflow. The flaw in OpenSSL which allows Linux/Slapper-B to spread was announced and fixed in an OpenSSL Security Advisory of 30 July 2002.

If Linux/Slapper-B successfully breaks into its victim, the worm injects a shell script into the remote shell it has launched. The shell script contains a uuencoded copy of the worm's own source code. The script decodes this source code into the file /tmp/.unlock.c, compiles it using gcc into the executable file /tmp/.unlock and then executes it. A daemon process called .unlock will be visible on infected computers.

Note that the Linux/Slapper-B worm depends on the presence of the gcc compiler on victim computers, and also requires that the compiler be executable by the Apache user. Sophos recommends removing, or limiting access to, the compiler on production web servers.

Once active, Linux/Slapper-B opens up a backdoor which can be contacted via UDP port 4156. The backdoor is intended to allow a range of attacks to be initiated from infected computers, such as: executing arbitrary commands; creating TCP floods; creating DNS floods and searching for email addresses on disk.

Further information from Sophos about how to protect against the Slapper family of worms is available here.


Recovery
Please read the instructions for removing worms.
Search for and kill any running processes named:
.unlock

Delete these files, if they exist:
/tmp/.unlock
/tmp/.unlock.c
/tmp/.unlock.uu
/tmp/.update.c
/tmp/update



More information about Linux/Slapper-B can be found at
http://www.sophos.com/virusinfo/analyses/linuxslapperb.html

 

Re:Linux/Slapper-A --Cure has been found!

Hello Everyone! This news article reads very much like Forum Admin's posting of September 15, 2002 except now F-Secure has a cure for it! See below.

F-Secure Plays Key Role In Slapping Down Slapper Worm
Helsinki, Finland - September 25, 2002

The threat of the Linux Slapper worm has been nullified by proactive anti-virus work by specialists at F-Secure. In what is believed to be the first action of its kind by an anti-virus company, F-Secure was able to identify exactly which Web servers were being infected as each infection happened, send a warning to the administrators of the infected systems, and offer a free version of F-Secure Anti-Virus for LinuxTM to remove the worm from their systems.

Read More.....

This is good business and good community relations for everyone! Well done!

Note: The above article is for informational purposes only (FYI) and not to be construed with expert advice. (I don't believe everything I read. Nor should you.) Thanks.

 

Re:Linux/Slapper-A --Cure has been found!

I do commend F-Secure for taking that action, but believe they have overstated the uniqueness of that approach as well as it's effectiveness.

I've been detecting worm infections for over two years now and now send upwards of 100,000 notification email/month...so this approach is certainly not new.

Also, there is no *reliable* way to identify the administrators of such systems as most infected IPs don't even have detailed Whois records (e.g. it just shows the ISPs email address). Even the IPs that have detailed Whois records are sorely out of date: invalid email addresses, people who left the company years ago, companies that don't even exist anymore due to mergers, etc..

I suspect that about 80% of whois records will show only an ISP email address..and unfortunately sending such notifications to ISP's abuse department is often a huge blackhole...at best the end-user will not even be notified for 4-6 WEEKS after the notice is sent...others (I suspect) completely ignore them due to lack of manpower to handle it (esp. during worm surges).

Yesterday, I sent out 8,000 Slapper infection notices, I received about 10 thank-you emails back.

So don't be fooled into thinking that just because F-secure sent out a bunch of emails that everyone is now aware of it.

Here we are 12 months after Code Red/Nimda first came out...I've probably sent 2 Million alert emails and we STILL have 50,000 CR/Nimda infected hosts (and new ones coming online ever day).