MS 0Day shows up on milw0rm

Printable View

October 29th, 2006, 08:41 AM
HTRegz

MS 0Day shows up on milw0rm

Hey Hey,

A new MS exploit showed up on milw0rm yesterday — http://www.milw0rm.com/exploits/2672 (Code is written in Python and quite easy to follow)…

Microsoft Windows NAT Helper Components (ipnathlp.dll) 0day Remote DoS Exploit

The exploit requires Internet Connection Sharing to be enabled and requires that the attacker be on the shared interface (from what I’ve seen in my playing thus far).

Malicious Person — Computer with ICS — Internet

I ran Windows Updates on an XP SP2 machine immediately prior to testing this… so it *SHOULD* have been fully up-to-date

I've got additional details (and will be adding more in the morning when I've had a chance to do some more serious debugging) available at http://www.computerdefense.org/?p=149

Peace,
HT

[Edit]
I've also submitted this to both SANS ISC and MSRC to ensure they're aware of it
[/Edit]
October 29th, 2006, 06:14 PM
HTRegz

Hey Hey,

I just wanted to point out that I was mentioned on SANS ISC -- http://isc.sans.org/diary.php?storyid=1809 for my report on this :)

That means in the last week I've been on ComputerWorld, the Sunbelt Software Blog and now this ;)

Peace,
HT
October 30th, 2006, 04:34 AM
HTRegz

Well, I guess I'll just keep replying to my own post :)

I'm looking for everyone to go digg this http://digg.com/security/New_MS_0day_on_milw0rm

Also.... I've posted a FAQ on the details of this over at the nCircle VERT blog.

http://blog.ncircle.com/archives/200...soft_ics_d.htm

Peace,
HT
October 30th, 2006, 04:28 PM
SirDice

Quote:

Originally Posted by HTRegz

That means in the last week I've been on ComputerWorld, the Sunbelt Software Blog and now this ;)

Keep up the good work :D
October 30th, 2006, 04:34 PM
deftones12

dugg :)
October 30th, 2006, 04:36 PM
morganlefay

Quote:

Originally Posted by HTRegz

Hey Hey,

I just wanted to point out that I was mentioned on SANS ISC -- http://isc.sans.org/diary.php?storyid=1809 for my report on this :)

That means in the last week I've been on ComputerWorld, the Sunbelt Software Blog and now this ;)

Peace,
HT

Thats great to hear HT.....I guess the move really panned out for you

MLF
October 30th, 2006, 05:41 PM
HTRegz

Quote:

Originally Posted by morganlefay

Thats great to hear HT.....I guess the move really panned out for you

MLF

Yeah definately :) things are going quite well.
October 31st, 2006, 03:03 AM
HTRegz

Hey Hey,

Now I'm just sharing links because I'm proud

http://www.infoworld.com/article/06/...irewall_1.html

http://www.hackinthebox.org/modules....icle&sid=21563
http://msmvps.com/blogs/harrywaldron...C-exploit.aspx
http://www.scmagazine.com/us/news/ar...wall-ics-wild/

http://isc.sans.org/diary.php?storyid=1809

Peace,
HT
October 31st, 2006, 02:23 PM
nebulus200

You made the front page of slashdot as well ;)

Quote:

New Windows Attack Can Disable Firewall
Posted by ScuttleMonkey on Tuesday October 31, @02:40AM
from the he-shoots-he-scores dept.
Windows
BobB writes to tell us NetworkWorld is reporting that new code released on Sunday could allow a fully patched Windows XP PC's personal firewall to be disabled via a malicious data packet. The exploit depends on the use of Microsoft's Internet Connection Service. From the article: "The attacker could send a malicious data packet to another PC using ICS that would cause the service to terminate. Because this service is connected to the Windows firewall, this packet would also cause the firewall to stop working, said Tyler Reguly, a research engineer at nCircle Network Security Inc."
October 31st, 2006, 03:15 PM
HTRegz

Quote:

Originally Posted by nebulus200

You made the front page of slashdot as well ;)

I just got an email from a co-worker I also made the front-page of digg... :)
October 31st, 2006, 03:42 PM
morganlefay

Thats just great HT.....

Good for you.....

Isnt it great when you work in something you love....and all the hard work you have put into it ...actually gets noticed.....recognized by your peers....

or even for that matter...by your employer
Doesnt happen often......at least not where I am :(

As I said before ...great job!!!!!

MLF
October 31st, 2006, 04:58 PM
phishphreek

You've also managed to piss some people off.

http://blogs.zdnet.com/Ou/?p=358

I was under the impression that you could disable ICS without shutting off your firewall. They are the same service, but you can uncheck "share this connection" or whatever and still have your firewall active.

I don't see a need to disable ICS at all. The chances are very low that someone on your INTERNAL network is going to attack the internet gateway. If so, you deserve it. Who would use a windows box with ICS or the ICF as their gateway/firewall anyway?! At LEAST use some third party software if you're going to do this. Something that will actually give you a little bit of control over your gateway.

Hardware routers/firewalls are a dime a dozen today and use far less energy than a full blown PC that has to be left on all the time.
October 31st, 2006, 05:14 PM
HTRegz

Quote:

Originally Posted by phishphreek80

You've also managed to piss some people off.

http://blogs.zdnet.com/Ou/?p=358

I was under the impression that you could disable ICS without shutting off your firewall. They are the same service, but you can uncheck "share this connection" or whatever and still have your firewall active.

I don't see a need to disable ICS at all. The chances are very low that someone on your INTERNAL network is going to attack the internet gateway. If so, you deserve it. Who would use a windows box as their gateway/firewall anyway?!

Hardware routers/firewalls are a dime a dozen today and use far less energy than a full blown PC that has to be left on all the time.

There are a few of these... I'm actually working through a rebuttal right now.. and yes you are correct, There is the parent service that is the same and it has two child services that can be enabled / disabled independantly...

And yes it is a low risk threat... but still a threat... The idea of a router is great... That would be what you'd do if you disabled ICS (i thought it was implied) when I said to disable that means of sharing the connection...

The risk isn't huge, but it does exist... My intention was to inform people of the risk... that was all... I will link my rebuttal post that has the explanation of why my options are perfectly valid once it is posted.

HT.
October 31st, 2006, 05:18 PM
morganlefay

Go get em HT :)

MLF
October 31st, 2006, 08:42 PM
HTRegz

I've posted my rebuttal @ http://blog.ncircle.com/archives/2006/10/me_blushes.htm
October 31st, 2006, 11:47 PM
HTRegz

By the way ...

*Points to the EIT Security Planets News at the top of the page*
November 1st, 2006, 03:33 AM
phishphreek

Quote:

Originally Posted by HTRegz

edited:
And yes it is a low risk threat... but still a threat... The idea of a router is great... That would be what you'd do if you disabled ICS (i thought it was implied) when I said to disable that means of sharing the connection...
edited:
HT.

Not necessarily. If you're going to use a dedicated box... please trust something that isn't based on m$. I've can't recall a "security" product from them that I would personally trust. If you can't afford a dedicated hardware router/firewall, there are alternatives.

http://ipcop.sourceforge.net/ comes to mind.

I've used it a couple of times now. Easy for any n00b to setup. Actually, easier than installing m$ with ICS and you can actually manage it! Plus, you might actually learn something about security! IDS/DNS/DHCP/Proxy/Firewall/VPN/Dynamic DNS/etc. all for the low cost of $0. Of course, I'm assuming you're going to install it on the box you were using ICS for. Well, ok, maybe $5 for a second nic... but still.

Not to mention, there are a sh17 load of plugins depending on your needs.

Either way. Nice handling of the situation. Some people jump the gun without understanding security or the inner working of the services they are reporting on. That guy george was completely clueless. I didn't pay much attention to this whole thing and I saw his blog post as what it was... BS.

The only thing I don't agree with, as you can see, is people using m$ as their freaking firewall/router. Stupid stupid stupid.
November 1st, 2006, 04:07 AM
HTRegz

Quote:

Originally Posted by phishphreek80

The only thing I don't agree with, as you can see, is people using m$ as their freaking firewall/router. Stupid stupid stupid.

It's not something that I condone either... then again I don't always condone the MS Firewall... but people do it... for better or worse they do it...

Great Example:

You go away to college/university... You've got a desktop and a laptop to take to class... Only 1 network jack in your dorm though... Network Policy says no Routers/Switches/Hubs... What do you do... Spoof the MAC Address so it doesn't look like linksys... then what if they do OS detection with nmap and determine what it is...(Not that you know any of this) you just know if they catch you with a router you lose your internet.. So you plug in your desktop.. pay the geek down the hall 20 bucks to setup ICS and away you go plugging your laptop into your desktop... (I saw this scenerio when I was working at the college)... Not that routers were checked for with those active measures... but a lot of students had ICS... many also had it because their parents had a computer and they bought theres.. when they go home for 4 months in the summer they share the connection... There are plenty of scenerios that geeks don't consider...

So take that same student... they pay to have it setup... the geek also gives them a User account to run with instead of Administrator (much more common in the colleges than you'd think.. .consider I thought I'd see 0%)... So you download malware... you have ics sharing with your laptop... the malware can't spread because of our firewall.. but if it uses this malformed DNS packet it can kill the firewall and spread away...

I'm not saying these are common or likely... but I have seen them.. and they do exist... Full Disclosure and informing the community means taking into account everyone.. even the lowest common denominator...

Just because I don't like Fords and I don't think many people drive escorts these days... should I not inform people that their Escort will explode if they drive for 10KM at under 25KM/hour...

Not arguing (since there's nothing to argue in this thread) just pointing out some ideas and thoughts on it..
November 1st, 2006, 04:50 PM
mohaughn

Ahh.. seems that some people are calling this publicity seeking FUD...

http://www.theregister.com/2006/11/0..._exploit_hype/
November 1st, 2006, 05:12 PM
morganlefay

http://www.computerworld.com/blogs/node/3862

A must read

LOL...

MLF
November 1st, 2006, 09:47 PM
HTRegz

Quote:

Originally Posted by mohaughn

Ahh.. seems that some people are calling this publicity seeking FUD...

http://www.theregister.com/2006/11/0..._exploit_hype/

It is what it is... Journalists need to direct it in a way that it attracts readers... the fact that it affects a few people doesn't make it any different that if it affected everyone... My release was an explanation of it... who it affected.. it was very clear... The press has their own way with things..

I don't think I'd call it FUD... The people that see it as FUD are those that jump to conclusions... It affects a small group yes... but the affect on that group is still real..

I can see plenty of comparisons for it... Let's say I go on the news and make a medical announcement... and I say "Diabetics between the ages of 30 and 35 who take insulin between the hours of 4 and 5am will have a horrid reaction and die. "... That affects very few people.. but is it FUD because I tell you??? Nope... everyone has the right to be informed of problems that affect them.. which is all I did.. and I stand by what I did..

MLF: I got a kick out of that blog posting as well.

Peace,
HT