Blaster (computer worm)

Last updated
Blaster
Blaster hex dump.png
Hex dump of the Blaster worm, showing a message left for Microsoft founder Bill Gates by the programmer
Technical nameAs Blaster
  • Worm.Win32.Blaster (Global Hauri)
  • W32/Blaster (Norman)
  • W32/Blaster (Sophos)
  • W32.Blaster.Worm (Symantec)

As Lovsan

As MSBLAST

  • Worm.Win32.Blaster (Global Hauri)
  • Win32/Msblast (Microsoft)
  • WORM_MSBLAST (Trend Micro)
Win32.Poza (CA) Blaster (Panda)
AliasesLovsan, Lovesan, MSBlast
Type Worm
Isolation2004
Point of originMinnesota (B variant only)
Author(s)Jeffrey Lee Parson (B variant only)
Port(s) used Remote Procedure Call
Operating system(s) affected Windows XP and Windows 2000

Blaster (also known as Lovsan, Lovesan, or MSBlast) was a computer worm that spread on computers running operating systems Windows XP and Windows 2000 during August 2003. [1]

Contents

The worm was first noticed and started spreading on August 11, 2003. The rate that it spread increased until the number of infections peaked on August 13, 2003. Once a network (such as a company or university) was infected, it spread more quickly within the network because firewalls typically did not prevent internal machines from using a certain port. [2] Filtering by ISPs and widespread publicity about the worm curbed the spread of Blaster.

In September 2003, Jeffrey Lee Parson, an 18-year-old from Hopkins, Minnesota, was indicted for creating the B variant of the Blaster worm; he admitted responsibility and was sentenced to an 18-month prison term in January 2005. [3] The author of the original A variant remains unknown.

Creation and effects

According to court papers, the original Blaster was created after security researchers from the Chinese group Xfocus reverse engineered the original Microsoft patch that allowed for execution of the attack. [4]

The worm spreads by exploiting a buffer overflow discovered by the Polish security research group Last Stage of Delirium [5] in the DCOM RPC service on the affected operating systems, for which a patch had been released one month earlier in MS03-026 [6] and later in MS03-039. [7] This allowed the worm to spread without users opening attachments simply by spamming itself to large numbers of random IP addresses. Four versions have been detected in the wild. [8] These are the most well-known exploits of the original flaw in RPC, but there were in fact another 12 different vulnerabilities that did not see as much media attention. [9]

The worm was programmed to start a SYN flood against port 80 of windowsupdate.com if the system date is after August 15 and before December 31 and after the 15th day of other months, thereby creating a distributed denial of service attack (DDoS) against the site. [8] The damage to Microsoft was minimal as the site targeted was windowsupdate.com, rather than windowsupdate.microsoft.com, to which the former was redirected. Microsoft temporarily shut down the targeted site to minimize potential effects from the worm.[ citation needed ]

The worm's executable, MSBlast.exe, [10] contains two messages. The first reads:

I just want to say LOVE YOU SAN!!

This message gave the worm the alternative name of Lovesan. The second reads:

billy gates why do you make this possible ? Stop making money
and fix your software!!

This is a message to Bill Gates, the co-founder of Microsoft and the target of the worm.

The worm also creates the following registry entry so that it is launched every time Windows starts:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ windows auto update=msblast.exe

Timeline

Side effects

Although the worm can only spread on systems running Windows 2000 or Windows XP, it can cause instability in the RPC service on systems running other versions of Windows NT, including Windows Server 2003 and Windows XP Professional x64 Edition. In particular, the worm does not spread in Windows Server 2003 because Windows Server 2003 was compiled with the /GS switch, which detected the buffer overflow and shut the RPCSS process down. [26] When infection occurs, the buffer overflow causes the RPC service to crash, leading Windows to display the following message and then automatically reboot, usually after 60 seconds. [27]

System Shutdown:

This system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by NT AUTHORITY\SYSTEM

Time before shutdown: hours:minutes:seconds

Message:

Windows must now restart because the Remote Procedure Call (RPC) Service terminated unexpectedly.

This was the first indication many users had an infection; it often occurred a few minutes after every startup on compromised machines. A simple resolution to stop countdown is to run the "shutdown /a" command, [28] causing some side effects such as an empty (without users) Welcome Screen. [29] The Welchia worm had a similar effect. Months later, the Sasser worm surfaced, which caused a similar message to appear.

See also

Related Research Articles

Klez is a computer worm that propagates via e-mail. It first appeared in October 2001 and was originated in China. A number of variants of the worm exist.

Sircam is a computer worm that first propagated in 2001 by e-mail in Microsoft Windows systems. It affected computers running Windows 95, Windows 98, and Windows Me (Millennium). It began with one of the following lines of text and had an attachment consisting of the worm's executable with some file from the infected computer appended:

SQL Slammer is a 2003 computer worm that caused a denial of service on some Internet hosts and dramatically slowed general Internet traffic. It also crashed routers around the world, causing even more slowdowns. It spread rapidly, infecting most of its 75,000 victims within 10 minutes.

<span class="mw-page-title-main">Timeline of computer viruses and worms</span> Computer malware timeline

This timeline of computer viruses and worms presents a chronological timeline of noteworthy computer viruses, computer worms, Trojan horses, similar malware, related research and events.

<span class="mw-page-title-main">Mydoom</span> Self-replicating malware program that spread by email

Mydoom was a computer worm that targeted computers running Microsoft Windows. It was first sighted on January 26, 2004. It became the fastest-spreading e-mail worm ever, exceeding previous records set by the Sobig worm and ILOVEYOU, a record which as of 2024 has yet to be surpassed.

Agobot, also frequently known as Gaobot, is a family of computer worms. Axel "Ago" Gembe, a German programmer also known for leaking Half-Life 2 a year before release, was responsible for writing the first version. The Agobot source code describes it as: “a modular IRC bot for Win32 / Linux”. Agobot was released under version 2 of the GNU General Public License. Agobot is a multi-threaded and mostly object oriented program written in C++ as well as a small amount of assembly. Agobot is an example of a Botnet that requires little or no programming knowledge to use.

Bolgimo is a Win32 computer worm, a self-replicating computer program similar to a computer virus, which propagates by attempting to exploit unpatched Windows computers vulnerable to the DCOM RPC Interface Buffer Overrun Vulnerability using TCP port 445 on a network. The worm was discovered on November 10, 2003, and targets Windows NT, 2000 and XP Operating Systems.

Welchia, also known as the "Nachi worm", is a computer worm that exploits a vulnerability in the Microsoft remote procedure call (RPC) service similar to the Blaster worm. However, unlike Blaster, it first searches for and deletes Blaster if it exists, then tries to download and install security patches from Microsoft that would prevent further infection by Blaster, so it is classified as a helpful worm. Welchia was successful in deleting Blaster, but Microsoft claimed that it was not always successful in applying their security patch.

Zotob is a computer worm which exploits security vulnerabilities in Microsoft operating systems like Windows 2000, including the MS05-039 plug-and-play vulnerability. This worm has been known to spread on Microsoft-ds or TCP port 445.

William Genovese is a former greyhat hacker turned security professional, who goes by the alias illwill.

W32.Navidad is a mass-mailing worm program or virus, discovered in December 2000 that ran on Windows 95, Windows 98, Windows NT, and Windows 2000 systems. It was designed to spread through email clients such as Microsoft Outlook while masquerading as an executable electronic Christmas card. Infected computers can be identified by blue eye icons which appear in the Windows system tray.

Stration is a family of computer worms that can affect computers running Microsoft Windows, disabling security features and propagating itself to other computers via e-mail attachments. This family of worms is unusual in that new variants are being produced at an unprecedented rate, estimated to be up to one every 30 minutes at its peak, and downloaded from remote servers by infected machines to speed propagation. This makes detection and removal a particular challenge for anti-virus software vendors, because new signature files for each variant need to be issued to allow their software to detect them.

<span class="mw-page-title-main">Storm Worm</span> Backdoor Trojan horse found in Windows

The Storm Worm is a phishing backdoor Trojan horse that affects computers using Microsoft operating systems, discovered on January 17, 2007. The worm is also known as:

Backdoor.Win32.IRCBot is a backdoor computer worm that is spread through MSN Messenger and Windows Live Messenger. Once installed on a PC, the worm copies itself into a Windows system folder, creates a new file displayed as "Windows Genuine Advantage Validation Notification" and becomes part of the computer's automatic startup. In addition, it attempts to send itself to all MSN contacts by offering an attachment named 'photos.zip'. Executing this file will install the worm onto the local PC. The Win32.IRCBot worm provides a backdoor server and allows a remote intruder to gain access and control over the computer via an Internet Relay Chat channel. This allows for confidential information to be transmitted to a hacker.

Koobface is a network worm that attacks Microsoft Windows, Mac OS X, and Linux platforms. This worm originally targeted users of networking websites like Facebook, Skype, Yahoo Messenger, and email websites such as GMail, Yahoo Mail, and AOL Mail. It also targets other networking websites, such as MySpace, Twitter, and it can infect other devices on the same local network. Technical support scammers also fraudulently claim to their intended victims that they have a Koobface infection on their computer by using fake popups and using built-in Windows programs.

<span class="mw-page-title-main">Conficker</span> Computer worm

Conficker, also known as Downup, Downadup and Kido, is a computer worm targeting the Microsoft Windows operating system that was first detected in November 2008. It uses flaws in Windows OS software and dictionary attacks on administrator passwords to propagate while forming a botnet, and has been unusually difficult to counter because of its combined use of many advanced malware techniques. The Conficker worm infected millions of computers including government, business and home computers in over 190 countries, making it the largest known computer worm infection since the 2003 SQL Slammer worm.

<span class="mw-page-title-main">Gruel (computer worm)</span> 2003 computer worm

Gruel, also referred to by F-Secure as Fakerr, was a worm first surfacing in 2003 targeting Microsoft Windows platforms such as Windows 9x, Windows ME, Windows 2000 and Windows XP. It spread via email and file sharing networks.

JASBUG is a security bug disclosed in February 2015 and affecting core components of the Microsoft Windows Operating System. The vulnerability dated back to 2000 and affected all supported editions of Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows RT, Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1.

<span class="mw-page-title-main">BlueKeep</span> Windows security hole

BlueKeep is a security vulnerability that was discovered in Microsoft's Remote Desktop Protocol (RDP) implementation, which allows for the possibility of remote code execution.

References

  1. "CERT Advisory CA-2003-20: W32/Blaster worm". CERT/CC. 2003-08-14. Archived from the original on 2014-10-17. Retrieved 2018-11-03.
  2. 1 2 3 "MS03-026: Buffer Overrun in RPC May Allow Code Execution". Microsoft Support. Microsoft Corporation. Retrieved 2018-11-03.
  3. "Minnesota Man Sentenced to 18 Months in Prison for Creating and Unleashing a Variant of the MS Blaster Computer Worm". United States Department of Justice. 2005-01-28. Retrieved 2021-02-17.
  4. Thomson, Iain (2003-09-01). "FBI arrests 'stupid' Blaster.B suspect". vnunet.com. Archived from the original on 2008-11-01. Retrieved 2018-11-03.
  5. 1 2 3 "MSBlast W32.Blaster.Worm / LovSan :: removal instructions". able2know.org. 2003-08-12. Retrieved 2018-11-03.
  6. "Microsoft Security Bulletin MS03-026 - Critical". learn.microsoft.com. 1 March 2023.
  7. "Microsoft Security Bulletin MS03-039 - Critical". learn.microsoft.com. 1 March 2023.
  8. 1 2 3 4 "W32.Blaster.Worm". Symantec. 2003-12-09. Archived from the original on May 17, 2018. Retrieved 2018-11-03.
  9. 1 2 "The Lifecycle of a Vulnerability" (PDF). internet Security Systems, Inc. 2005. Archived from the original (PDF) on 2016-12-24. Retrieved 2018-11-03.
  10. "Worm:Win32/Msblast.A". Microsoft Corporation. Retrieved 2018-11-03.
  11. Bransfield, Gene (2003-12-18). "The Welchia Worm" (PDF). pp. 14, 17. Retrieved 2018-11-03.
  12. "Buffer Overrun in Windows Kernel Message Handling could Lead to Elevated Privileges (811493)" . Retrieved 2018-11-03.
  13. "Flaw In Microsoft Windows RPC Implementation". 2003-07-16. Archived from the original on 2016-03-04.
  14. 1 2 "Buffer Overflow in Microsoft RPC". 2003-08-08. Archived from the original on 2014-07-15. Retrieved 2018-11-03.
  15. "The Analysis of LSD's Buffer Overrun in Windows RPC Interface". 2003-07-25. Archived from the original on 2018-02-17. Retrieved 2018-11-03.
  16. 1 2 3 4 Roberts, Paul F. (2003-08-12). "Blaster worm spreading, experts warn of attack". InfoWorld. Retrieved 2018-11-03.
  17. Roberts, Paul F. (2003-08-13). "New Blaster worm variant on the loose". InfoWorld. Retrieved 2018-11-03.
  18. Roberts, Paul F. (2003-08-18). "Blaster worm attack a bust". InfoWorld. Retrieved 2018-11-03.
  19. "Virus alert about the Blaster worm and its variants". Microsoft Support. Microsoft Corporation. Retrieved 2018-11-03.
  20. 1 2 3 "W32.Welchia.Worm". Symantec. 2017-08-11. Archived from the original on September 3, 2018. Retrieved 2018-11-03.
  21. Naraine, Ryan (2003-08-19). "'Friendly' Welchia Worm Wreaking Havoc". InternetNews.com. Retrieved 2018-11-03.
  22. 1 2 3 "Virus Profile: W32/Lovsan.worm.a". McAfee. 2003-08-11. Retrieved 2018-11-03.
  23. "A tool is available to remove Blaster worm and Nachi worm infections from computers that are running Windows 2000 or Windows XP". Microsoft Support. Microsoft Corporation. Archived from the original on 2014-08-06. Retrieved 2018-11-03.
  24. "W32.Welchia.C.Worm". Symantec. 2007-02-13. Archived from the original on November 3, 2018. Retrieved 2018-11-03.
  25. "Minnesota Man Sentenced to 18 Months in Prison for Creating and Unleashing a Variant of the MS Blaster Computer Worm". 2005-01-28. Archived from the original on 2014-07-14. Retrieved 2018-11-03.
  26. Howard, Michael (2004-05-23). "Why Blaster did not infect Windows Server 2003". Microsoft Developer. Microsoft Corporation. Retrieved 2018-11-03.
  27. "Worm_MSBlast.A". TrendMicro.com. Retrieved 2018-11-03.
  28. "Blaster Worm-Virus or Its Variants Cause the Computer to Shutdown with an NT AUTHORITY\SYSTEM Error Message Regarding Remote Procedure Call (RPC) Service". HP Consumer Support. HP. Archived from the original on 2014-11-10. Retrieved 2018-11-03.
  29. "Blaster Worm". Techopedia. Retrieved 2018-11-03.