They're Baaack! Hackers Renew Windows 'MS06-040' Attacks

An upswing in activity related to a potential Windows Server vulnerability dubbed with a most-dangerous label in early August has been detected by security companies and organizations.

That earlier vulnerability came to light August 8, amid Microsoft's release of a dozen security bulletins. These included MS06-040, which patched a critical vulnerability in Windows' Server service. At the time, security analysts warned that the bug might be exploited by a network-attacking worm, ala MSBlast. Although several exploits appeared, their impact was minor.

On Thursday, both Symantec and the SANS Institute's Internet Storm Center alerted users that they had detected a significant increase worldwide in activity on port 139, one of the two ports which an exploit against the MS06-040 vulnerability would use to attack systems.

The Internet Storm Center (ISC) spotted a major spike in port 139 activity starting Sunday, Aug. 27, while Symantec's sensor network recorded large increases on both Tuesday, Aug. 29 and Wednesday, Aug. 30. According to Symantec, the systems attacking port 139 were also involved in attacks on port 445, the other likely route attackers exploiting the Server service would use.

"There could be several possibilities for this," said Lorna Hutcheson, an analyst with the ISC, in an online note. But she discounted earlier bots that had circulated soon after MS06-040 was released. "Both were [recognized] on August 14, so they have been around for a whileand this upswing just started over the past couple of days," Hutcheson wrote. Generally, a jump in activity against one or more of Windows' ports means that attackers are scanning the Internet for vulnerable systems.

Symantec's analysis was more specific in pegging possible causes for the uptick in port 139 activity.

"A new variant of Spybot named W32.Spybot.AKNO has been discovered propagating in the wild," Symantec said in a warning issued early Thursday to users of its DeepSight threat management service. The bot -- designed to infiltrate a system, then download additional malicious code to hijack the computer so it can be used as a spam zombie or for other criminal activities -- also contains a rootkit component, Symantec added. A rootkit is code that cloaks a worm or bot to make it harder for anti-virus software to both detect and delete the malware.

"That Spybot picked this up [an MS06-040 exploit] isn't surprising," said David Cole, the director of Symantec's security response team. "Spybot is one of the most prevalent bots out there. What is interesting is that it also threw in rootkit capabilities." Symantec also said that it had received reports of a worm in the wild that was using the MS06-040 vulnerability to attack PCs running Windows NT 4.0. An initial report posted to the Full Disclosure security mailing list was "extremely vague," said Symantec, which has been unable to reach the researcher who reported the worm, and so has no sample code to examine. Other researchers writing to the Full-Disclosure noted that the malicious code also successfully attacks Windows 2000 systems.

The new Spybot and the attack against Windows NT machines seem to be separate, Symantec said. It has deployed honey pot systems in the hopes of collecting a sample of the new NT worm.

Windows NT users are particularly vulnerable to attack, Cole added, since the aged operating system has been dropped from Microsoft's support list; the Redmond, Wash. developer stopped issuing security fixes for NT on the last day of 2004.

"There's been a lot of activity exploiting the MS06-040 vulnerability," said Cole. "Randex, Stration, a number of threats. Once an exploit is released, everyone scrambles to include it."

By Symantec's tally, six known bots are leveraging the MS06-040 exploit. That was enough for the Cupertino, Calif. security company to push its ThreatCon security status ranking from "1" to "2" on Thursday.

"It's a cumulative thing," said Cole, acknowledging that no single exploit caused the company to up its alert level. "The increase in infection angles and the activity on port 139 and 445 shows it's a problem across the board."

Both Symantec and the ISC urged users to patch their systems with the fix issued with MS06-040. If patching isn't possible -- or one is simply not available, as is the case for Windows NT users -- users should filter or block TCP ports 139 and 445, the pair advised.