For Official Department of Energy Use Only _______________________________________________________________________ THE COMPUTER INCIDENT ADVISORY CAPABILITY (CIAC) ADVISORY NOTICE _______________________________________________________________________ Tools available to check the spread of the "WANK" Worm October 20, 1989 1130 PST Number A-3 Summary This is a follow-up bulletin to the CIAC advisory notice A-2 dated October 16, 1989, stating that the "WANK" worm is attacking HEPnet and the NASA SPAN network on VAX/VMS systems connected via DECnet. Our latest information is that approximately 60 to 70 systems, mostly at non-DOE sites, have been infected. The rate at which this worm is spreading seems to be slowing, although more detailed information about the spread of this worm is not currently available. CIAC now has additional information about the "WANK" computer worm outbreak. The worm targets VMS machines, and can only be propagated via DECnet. The worm exploits well known security holes within the DECnet/VMS system in order to propagate itself. However, most DOE sites have not yet been affected. In order to help prevent your site >from becoming infected, we recommend that you follow procedures described in this bulletin , and use a tool to check your VAX/VMS systems for the same weaknesses the worm exploits. We also are providing you with a list of the worm symptoms, as well as a tool to kill the worm if your systems become infected. If your site is infected, or if you have any questions, please contact CIAC. CIAC phone numbers and addresses appear at the end of this notice. Advisory Notice A computer worm written in DCL for DEC-VMS has been attacking the HEPnet and the NASA SPAN networks. This worm can only be propagated via DECnet. The primary methods of attack include a brute force attack on passwords as well as exploiting well known security vulnerabilities of DECnet/VMS. One vulnerability is the default DECnet account, which is a facility for users who do not have a specific login ID for a machine and want some degree of anonymous access. It uses the default DECnet account to copy itself to a machine, and then uses the "TASK 0" and Submit/Remote features of DECnet to invoke the remote copy. Once the worm has successfully penetrated a system, it will infect .COM files and create new security vulnerabilities. It then broadcasts these vulnerabilities to another machine. It may also damage files or crash systems. In our last memo we published an analysis of the worm by Kevin Oberman. That analysis contained a error that we would like to correct. In that notice we printed the quote: 4. Information on the password used to access the system is mailed to the user GEMTOP on SPAN node 6.59. Some versions may have a different address. The actual user is "GEMPAK" not "GEMTOP". Visible Symptoms The following information is an extract from a report by John McMahon on detecting the symptoms of the WANK worm. This information was compiled after a thorough analysis of copies of various versions of the WANK worm retrieved from different infected sites. There are indications that these copies were derived from three different "starter" versions of the worm. The worm is self-modifying, and may also have been manually modified by others. There may also be other currently undetected versions of the worm with additional capabilities. Specifically, some or all of the following symptoms have been noted on infected systems: 1) Account passwords have been changed without the knowledge of the user, or the system manager. 2) Processes are running on your system with the process name NETW_nnnn (where nnnn is a random number). Check this with the SHOW SYSTEM command. 3) Command procedures/data file names starting with one or two letters and up to a five digit number appear in the SYS$LOGIN: directory of an account. Examples: C12345.COM, A7007.DAT. Note: Earlier reports that the file W.COM is created by the worm appear to be in error. Any "anti-worm" procedure involving the creation of a blank W.COM;32767 will NOT stop the worm. 4) The SYS$ANNOUNCE message, prior to the USERNAME: login prompt, has been redefined to the following WANK logo. W O R M S A G A I N S T N U C L E A R K I L L E R S _______________________________________________________________ \__ ____________ _____ ________ ____ ____ __ _____/ \ \ \ /\ / / / /\ \ | \ \ | | | | / / / \ \ \ / \ / / / /__\ \ | |\ \ | | | |/ / / \ \ \/ /\ \/ / / ______ \ | | \ \| | | |\ \ / \_\ /__\ /____/ /______\ \____| |__\ | |____| |_\ \_/ \___________________________________________________/ \ / \ Your System Has Been Officically WANKed / \_____________________________________________/ You talk of times of peace for all, and then prepare for war. 5) The SYSTEM account can no longer receive mail. The DISMAIL flag has been set in SYSTEM's UAF record. 6) Users log into the system and report that all of their files have been deleted while logging in. The user observes many %DELETE-I-FILDEL messages ,and DIRECTORY reports that no files are found. The system manager follows up on this report and finds the files are still there, and that the system login procedure (SYLOGIN, SYS$SYLOGIN) has been modified. Note: Earlier reports that the worm performs mass deletion of files appears to be in error. 7) Command procedures have been modified with code to reactivate the FIELD account if the person running the procedure has SYSPRV. 8) A remote DECnet site contacts you about odd VAXPhone call messages coming from your node. The VAXPhone ring messages do not contain a userid, but a strange "fortune cookie" saying. Note: the node id can be found in the NETSERVER.LOG files in your DECnet default account. [CIAC note]: Please note the node number of the system that sent you the message and pass that information to your respective network security manager, or CIAC so that the infected node can be informed. 9) Top-level directories have had their OWNER protection field changed to O:RWED. 10) A remote DECnet site contacts you about logfails (on several accounts) on the remote site which were traced back to an account on your machine. Similarly, a remote site contacts you because a local account tried to read the SYSUAF/RIGHTSLIST files on the remote node. Regardless of whether or not you think you have been infected, download the ANTIWANK.COM command procedure and start it running on your node immediately. This program will kill copies of the worm that are running on your node. You may see the whole list of symptoms and recommended fixes by obtaining the file WORM-INFO.COM. See details below. Procedures to stop the spread of this worm CIAC recommends that you use the following procedures, quoted from a message by Ron Tencati (SPAN Security Manager), to stop the spread of the WANK worm: 1) It is IMPERATIVE that all systems protect or remove the DECnet TASK 0 object to prevent reoccurrence of this worm, OR MORE SERIOUS ATTACKS OF THIS KIND IN THE FUTURE! The TASK object can be secured by either of the following methods: Method 1) Issue the command: NCP> CLEAR OBJECT TASK ALL after the network is started up. This command can also be inserted into the procedure SYSTARTUP>COM (SYSTARTUP_V5.COM on V5.x systems) after the call to STARTNET.COM. In addition which the system is running, this command must be executed EACH TIME the network is restarted. Method 2: Issue the following commands ONCE: NCP> SET OBJECT TASK USER DECNET PASSWORD NCP> DEFINE OBJECT TASK USER DECNET PASSWORD This causes a login failure to be generated whenever the TASK object is accessed. Once done, this change will be permanent. NOTE We have received one report that TASK 0 is required for DECwindows. Read your documentation! 2) Under NO circumstances it is acceptable for an account to have a password the same as the username. Passwords (passPHRASES) should be created so that they are difficult to guess, multi- word phrases are preferable. As a precaution, we recommend that all passwords be changed. Additionally, system managers may choose to revalidate ALL accounts. If a system had the DECNET TASK 0 protected as above, the DECNET account protected against SUBMIT/REMOTE (described below) and no user had their userid as their password, it was immune to this WORM. As a result, the number of nodes actually INFECTED by this attack is relatively small. The number ATTACKED however, is large. 3. NETWORK ATTACKS To protect against the SUBMIT/REMOTE attack, run AUTHORIZE and make sure that all network account flags are set to NOBATCH, NODIALUP, NOLOCAL, and NOREMOTE. 4. FIELD ACCOUNT Make sure the FIELD ACCOUNT does not have the password FIELD. DISUSER the account. You must SEARCH all .COM files for a "field/remote/dialup." If the search shows it is in .COM files, They have a trojan horse appended to the files. When the .COM file is executed, This Trojan horse will try to reset account FIELD to /NODISUSER and password to FIELD. You should either delete the corrupted .COM file and obtain a good one elsewhere, or examine the file and remove the affected lines of the command procedure. 5. WORM FILES The WORM source files are W.COM or a single alphabetic character (C or D) followed by 4 or 5 numeric characters. (Cnnnnn.COM), ("nnnn" represents a random number). The WORM will start a process or processes running. These processes are named in format NETW_nnnn, and should be deleted. PHONE_nnnn may also be running as the WORM utilizes the PHONE object in an attempt to send a message to a user on another randomly selected node. 6. ALARMS Some alarms generated by the WORM are related to PHONE.EXE and FAL.EXE. The majority of the alarms are login failures as the WORM attempts to log into specific accounts. We recommend that alarms be set immediately for logins, logouts, breakin attempts, modifications to the system and net UAF's, and to changes to user and system passwords. Tools available A series of tools are available to control the WANK worm. These may be obtained by anonymous FTP access from node ROGUE.LLNL.GOV (128.115.2.99). They may also be obtained from SPAN and ESnet. Contact CIAC for more information. [.SECURITY]CHECK_SYSTEM.COM, written by Kevin Oberman, will check your entire system for the security holes used by the WANK worm. It then reports back all system problems so that they can be corrected. DEC has provided a fix for the well known problem with the default DECnet account hole called SYS$UPDATE:NETCONFIG_UPDATE.COM for VMS V5.2. It is available from the VMS V5.2 distribution tape. If you have this, CIAC recommends that you run it now. If you donUt have access or are running an earlier system such as V4., you may obtain >from ROGUE.LLNL.GOV a program called: FIX-FAL.COM which fixes the default DECnet account. The program by John McMahon can be obtained by downloading ANTIWANK.COM. This program kills the worm processes. You can also run it as a vaccine even if your systems have not been infected. WORM-INFO.TXT contains an important report by John McMahon . It contains a list of symptoms, recommended proceduresand the code for ANTIWANK.COM. If your site has been infected, or if you have any questions, please contact either of the following CIAC team members: David Brown, (415) 423-9878 or FTS 543-9878 Gene Schultz, (415) 422-8193 or FTS 532-8193 or send electronic mail to:ciac@tiger.llnl.gov CIAC FAX: (415) 422-4294 FTS 532-4294