[60407] in North American Network Operators' Group
RE: RPC errors
daemon@ATHENA.MIT.EDU (Brennan_Murphy@NAI.com)
Mon Aug 11 18:08:08 2003
Date: Mon, 11 Aug 2003 15:05:39 -0700
From: <Brennan_Murphy@NAI.com>
To: <john@dvorak.net>, <nanog@merit.edu>
Errors-To: owner-nanog-outgoing@merit.edu
does anyone know if the scanning is sequential once
a range is chosen or is it random within a range?
e.g.,
1.1.1.1
1.1.1.2
1.1.1.3
etc
or=20
1.1.1.89
1.1.1.33
1.1.1.12
etc
-----Original Message-----
From: John Dvorak [mailto:john@dvorak.net]=20
Sent: Monday, August 11, 2003 5:57 PM
To: NANOG
Subject: Re: RPC errors
On Mon, 11 Aug 2003 17:33:33 -0400
Kevin Houle <kjh@cert.org> wrote:
>=20
> --On Monday, August 11, 2003 02:26:40 PM -0700 Mike Damm=20
> <MikeD@irwinresearch.com> wrote:
>=20
> >The DCOM exploit that is floating around crashes the Windows RPC=20
> >service when the attacker closes the connection to your system after=20
> >a successful attack. Best bet is to assume any occurrence of crashing
> >RPC services to be signs of a compromised system until proven=20
> >otherwise.
> >
> >http://www.cert.org/advisories/CA-2003-19.html
>=20
> That's good advice. Many of the known exploits cause the RPC service=20
> to crash after the exploit is successful. I'll point out that not all=20
> exploits cause the service failure. So, the absence of an RPC service=20
> failure is likewise not an indicator that a vulnerable machine has=20
> escaped compromise.
>=20
> Kevin
Interestingly, we have clear examples of boxes which were not infected
but on which RPC services did crash. This may suggest that the worm
also takes advantage of the unrelated RPC DOS vulnerability (2000 and
XP) which I believe MS has still not patched.
John
