Thursday, April 15, 2010

DIR ADVISORY

DIR ADVISORY-- W32.Qakbot Worm , Compromised FTP sites and Government Systems

DIR has been made aware of some FTP servers, located in the US and abroad that have received keystroke logging data files from infected systems.
W32.Qakbot, first identified in May 2009, is a worm that spreads through network shares. It downloads additional files, steals confidential information, and opens a back door on the compromised computer. The worm also contains rootkit functionality to allow it to hide its presence.  Most, if not all, updated Anti-Virus solutions prevent this year-old worm from infecting systems.
The worm spreads by exploiting vulnerabilities when a user visits certain Web pages. Exploit code hosted at these remote locations downloads the threat on to the compromised computer. Many of the infections are aided by users unwittingly clicking on malicious links. The worm also spreads through network shares by copying itself to shared folders when instructed to by a remote attacker.
While W32.Qakbot has multiple capabilities, its ultimate goal is clearly theft of information. W32.Qakbot is capable of gathering a number of different kinds of information, including the following confidential information:
  • Authentication cookies, including Flash cookies
  • DNS, IP, hostname details
  • OS and system information
  • Geographic and browser version information
  • Keystrokes including login information
  • Login details for FTP, IRC, POP3 email, and IMAP email
  • Outlook account information
  • Private keys from system certificates
  • Login credentials for certain websites
  • URLs visited
1.      PREVENTION AND AVOIDANCE
The following actions can be taken to avoid or minimize the risk from this threat.

1.1  Update and enable Anti-virus software
A first line of defense; organizations and users are encouraged to review the details outlined in this advisory, update anti-virus versions and definitions, and ensure that anti-virus software is actually enabled and working.

1.2 Patch Operating System and Software
Users are advised to ensure that their operating systems and any installed software are fully patched, and that firewall software is up to date and operational. Users are recommended to turn on automatic updates if available so that their computers can receive the latest patches and updates when they are distributed by vendors.

This threat is known to be spread by exploiting certain vulnerabilities. Installation of patches for the following vulnerabilities will reduce the risk to your computer.
1.3 User Behavior and Precautions
Users are advised not to open or execute files from unknown sources. It is also advisable to disable the execution of JavaScript in client applications to prevent execution of unwanted scripts.

Users should turn off file sharing if its use is not required. If file sharing is required, users should use ACLs and password protection to limit access. In addition to this, the use of a firewall or IDS may block or detect back door server communications with remote client applications.

1.4 Address Blocking
Block access to the following addresses using a firewall or router, or add entries to the local hosts files to redirect the following addresses to 127.0.0.1:

  • A[.]rtbn2[.]cn
  • adserv[.]co[.]in
  • c[.]rtbn2[.]cn
         gator862[.]hostgator.com
         ftp[.]5150[.]clanservers[.]com
  • ftp[.]abid.co[.]cc
  • ftp[.]buldrip.com
  • ftp[.]dfarchs[.]com
  • ftp[.]fantasyworldtravel[.]net
  • ftp[.]successful-marketers[.]com
  • hostrmeter[.]com
  • nt002[.]cn
  • nt010[.]cn
  • nt202[.]cn
  • up002[.]cn
  • up004[.]cn
  • uu002[.]cn
  • w1[.]webinspector[.]biz
  • web192[.]ixwebhosting[.]com
  • www[.]cdcdcdcdc212121cdsfdfd[.]com
  • www[.]cdcdcdcdc2121cdsfdfd[.]com
  • zenpayday[.]com
  • zurnretail[.]com

1.5 Network Port Blocking
Some of the vulnerabilities used to compromise computers have been known to use a TCP port between 16666 and 16669 to spread. Blocking this port range at the network perimeter may help to reduce the risk to your computer.


1.6 Network Shares
This threat is also known to spread inside networks by using shares. The following steps can help protect your computer against this threat:
  • Users are advised to ensure that all network shares are only opened when they are necessary for use.
  • Use a strong password to guard any shared folders or accounts. A strong password is a password that is of sufficient length of 8 or more characters. The password should also use a combination of numeric, capital and lowercase characters, along with one or more symbols. Commonly used words from everyday language should not be used as they may easily be defeated by a dictionary attack.
  • Disable the autorun feature to prevent dropped files from running automatically when a network drive is opened.
IMPORTANT:  If a state system has been determined to have been infected with this worm, please notify DIR Security immediately: dir.security@dir.state.tx.us
In a related action, DIRimplemented blocking of all traffic destined to the following IP addresses, as noted in an earlier NSOC Blocking Notice :
206.188.193.195

174.120.28.2

12.97.188.57

 62.204.145.206 

 66.55.132.6

Security Incident Reporting Instructions:
Note: The 24/7 emergency number for the Security Office is 512-350-3282.
The secondary contact is Kevin White, 512-463-7189 (office) or 512-762-3172 (cell).
DIR Security

77 comments:

  1. Thank you for the good article.
    I totally agree. I have experienced the similar situation in my work system. It has caused many issues and data loss. Since that time we use data room service providers in order to prevent such problems from happening.

    ReplyDelete
    Replies
    1. pour-over–quality coffee but the convenience of a one-button machine, we recommend the OXO Brew 9 Cup Coffee ... Drip best coffee makers · Ninja Hot & Cold Brew System · Breville Precision Brewer · Bonavita BV1900TS · Technivorm Moccamaster KB 741.

      Delete
    2. best wireless earbuds workout earbuds: Jabra Elite Active 75t; Jaybird Vista; Bose Sport Earbuds; Beats Powerbeats Pro; Anker SoundCore Apple, Sony, Bose, Anker, and more, across a range of budgets, these are the seven best true wireless earbuds in 2021.

      Delete
    3. Best Wi-Fi routers under Rs 2,000 for small homes · best router give you Internet speeds up to 300Mbps · Best WiFi Routers Updated 2021 this router can be expanded via Asus' AiMesh that allows additional Asus routers Editors choice: NETGEAR Nighthawk X6S AC4000 Tri-band WiFi Router ·

      Delete
    4. 4 slice toaster from Russell Hobbs. Thanks to Faster best toasters Technology which uses a powerful heating. Best 4-Slice Toasters at a Glance · Best Overall: Cuisinart 4-Slice Metal Classic Toaster · Best Rated: Sencor Stainless Steel 4-Slice Toaster · Best Toasters in 2020 - Top Toaster Picks

      Delete
    5. Best - Kitchen Faucets: we've got it. Take advantage of unbeatable inventory and prices from Quebec's expert in construction & renovation. Online shopping for modern best kitchen faucets : bronze, brass, stainless steel, brushed nickel, white.

      Delete
    6. So informative, thanks to author. Don't you think it's worth posting these thoughts on Instagram? After all, this social network is now very popular. By the way, I advise you to use https://viplikes.net/buy-instagram-followers in order to quickly increase the number of followers and promote your account to the top.

      Delete
  2. "The worm spreads by exploiting vulnerabilities when a user visits certain Web pages. Exploit code hosted at these remote locations downloads the threat on to the compromised computer."

    Very good words.
    Thank y for great blog.
    security-online.net

    ReplyDelete
    Replies
    1. Very nice post, impressive. its quite different from other posts. Thanks for sharing.
      Student Visa For Canada

      Delete
  3. I am happy to this blog site giving one-of-a-kind and also useful knowledge concerning this topic. smsf advisory

    ReplyDelete
  4. Nice post . This post was very useful for me . I got many information from this post . click this

    ReplyDelete
  5. We provide cheap golf products. On some products have discount offer. If you buy two golf product you will get one product free. These products are light in weight. Quality of these products are good. Here you will find all sizes of golf product. For more information you can visit on our website click this

    ReplyDelete
  6. We provide cheap theme and plugin. On some paid theme and plugin have discount offer. If you buy two theme and plugin you will get more discount. Here you will find free theme and plugin. Design of free theme and plugin are good. For more information you can visit on our website click this . We also provide wp rocket plugin click this

    ReplyDelete
  7. We do SEO to increase website rank in google search engine. It give a boost energy to website in google search engine. We make backlinks on high DA and PA website. We follow the guidelines of google search engine. For more information you can visit on our website click this . We also give tips of how to start a blog and earn money click this

    ReplyDelete
  8. We provide cheap paddle boards. On some paddle boards have discount offer. These paddle boards are light in weight. Quality of these paddleboards are good. Here you will find all sizes of paddle boards. For more information you can visit on our website click this

    ReplyDelete
  9. We provide free and paid hosting . On some paid hosting have discount offer. If you buy two hosting you will get more discount. You can use free hosting for maximum one year. After one year you have to pay for continuous. Speed of free hosting is very fast. We also provide share hosting and cloud ways hosting . Both hosting are best for your website. For more information you can visit on our website click this . We also provide hostinger hosting review click this

    ReplyDelete
  10. We provide all company customer care number. All numbers are toll free number. If your product damage within warranty you can visit on our website and get the number of that company and call them and replace your product. Services of these numbers are 24*7 days. For more information you can visit on our website click this . We also provide ekart customer care number click this

    ReplyDelete
  11. We provide cheap artificial product. On some products have discount offer. These products are light in weight. Quality of these products are good. Here you will find all sizes of artificial product. For more information you can visit on our website . jewelery set his . We also provide earing set for women earings for women

    ReplyDelete
  12. Hi, I really enjoyed reading your post, and hope to read more. thank you so much for sharing this informative blog. You may also like things to say when someone dies

    ReplyDelete
  13. Wow, superb blog structure! How long have you been blogging for? you make blogging glance easy. do my homework assignment online The total look of your website is excellent, let alone the content!

    ReplyDelete
  14. What an interesting story! I'm glad I finally found what I was looking for Excellent reading 중국야동넷

    Also feel free to visit may webpage check this link
    야설

    ReplyDelete

  15. Very informative post I really like it. Happy to hear about it more.mass effect n7 jacket

    ReplyDelete
  16. Thanks for this post.
    Going to use this software. Seems very helpful to me. I also think you should download quickbooks tool hub and once you have it you will stop worrying about your data.

    ReplyDelete
  17. Exactly when you reveal an associate relationship—and you should, considering the way that as we actually noted, gathering trust is a certain need—buyers will see the worth in your reliability and will wouldn't pressure adding to your vital worry by using your connection (the converse can be liberal; in case they feel you're not talking reality regarding your affiliations, they may go clearly to the dealer just to advance an endeavor not to give you the reference credit!).
    By: amazon nhs discount

    ReplyDelete
  18. Very nice post. I just stumbled upon your blog and wished to say that I’ve truly enjoyed surfing around your blog posts. If you facing any sexual issue You can contactSexologist in delhi

    ReplyDelete
  19. Very nice post. I just stumbled upon your blog and wished to say that I’ve truly enjoyed surfing around your blog posts. If you facing any sexual issue You can contactsexologist doctor

    ReplyDelete
  20. Really amazing article it was informative as usual . i can say you have cover every point and make things very interesting keep posting . thanks for sharing visit my website if you are facing any problem regarding sexual problem sexologists in delhi

    ReplyDelete
  21. NICE BLOG
    Quickbooks Error 15222 When you have to deal with such an issue, it may be aggravating. All of your QuickBooks-related work comes to a standstill. Even the most fundamental functions are covered. We are, fortunately, here to assist you. You may quickly remove this problem from your QuickBooks programme with the aid of this article. All you have to do now is attentively follow the guidelines that we have provided.

    ReplyDelete
  22. Articles composing administrations are totally lawful and work like some other specialist organization. They are enrolled elements and Pay For Essay work under the current regulation of your country. No regulations confine understudies from requesting papers on the web or looking for proficient scholarly assistance.

    ReplyDelete
  23. Amazing blog! This is really helpful and informative for me and all the readers.If you are looking to buy an online oscola reference generator service at an affordable and reasonable price.

    ReplyDelete
  24. Exceptionally useful post! There is a considerable measure of data here that can enable any business to begin with a fruitful long range informal communication campaign! 파워볼게임

    ReplyDelete
  25. This is an excellent post for Governmet workers and they can get detailed information about the FTP servers and protocols by using these methods. Its very important to keep your system updated and error free. I will also check complete information about the sever protocols guide to get rid of errors and infected worms.
    Write My Assignment

    ReplyDelete
  26. I think this is one of the most significant pieces of information about Hair Serum For Sale Online Usa for me. And I'm glad to read your post. Thank you for sharing!

    ReplyDelete
  27. Wow, that’s what I was exploring for, what a stuff! existing here at this web site, thanks admin of this web page. 토토사이트

    ReplyDelete
  28. You’ve made some decent points there. I checked on the internet for additional information about the issue and found most individuals will go along with your views on this website. 파워볼게임

    ReplyDelete
  29. Everyone loves what you guys are up too. This type of clever work and coverage! Keep up the great works guys I’ve incorporated you guys to my own blogroll. 안전놀이터

    ReplyDelete
  30. Interesting, I saw your article on google, very interesting to read. I have seen this blog, it is very nice to read and has more informative information. 룰렛 토토사이트 토토 바카라사이트

    ReplyDelete
  31. Greetings! Very useful advice in this particular post! It’s the little changes that make the greatest changes. Thanks a lot for sharing!
    Bicycle Accident Lawyer Canada

    ReplyDelete
  32. my websiteKORG PA Manager Crack is an application used by professionals. They used this app to connect their musical instruments to a server. This application plays the role of a server for the various connected devicesmy website

    ReplyDelete
  33. I felt you are so kind when you shared the DIR advisory with us, but there is a little confusion. Can you please tell us for how long this advisory will work for us? Dissertation Grade

    ReplyDelete
  34. What Is The Right Way To Fix Negative Balance On The Cash App?
    You don’t need to take stress if your Cash App is showing the negative balance on your Cash App account. Besides, if you are one of those who want to deal with the Negative Balance On The Cash App, you have to simply add some money to the wallet of your account with ease


    ReplyDelete
  35. Thanks a bunch for sharing this with all people you actually recognise what you’re speaking approximately! Bookmarked.
    majortotositecom2
    racesitepro2
    oncasinositenet2
    totopickpro2

    ReplyDelete
  36. HealthPost Coupons code is best code provided by HealthPost . Amazing Discount Offers, Get HealthPost & Promo Codes and save up to 45% on the offer, so get the code helps you to save on coupon and promo codes.

    ReplyDelete
  37. The Best Service Provider - Creativeware

    Creativeware is a full service design and fabrication studio specializing in Art fabrication, custom furniture, architectural installation, prototyping, custom lighting, commercial/home interior design, CNC machining, consultation etc.

    ReplyDelete
  38. we make the learning curve as easy as possible by providing free getting started videos and an online help guide. flexisign crack Once you’re up and running, dive into our playlist of tips and tricks videos mixed in key crack downloadable training DVDs, or consider joining one of our hands-on classes at distributors global mapper crack As the first company in the industry to launch a mobile app, optional cloud-based trading tools best non comedogenic face moisturizer and flexible purchasing options, SAi Flexi leads the charge as the most innovative software. how to use laptop as monitor for switch

    ReplyDelete
  39. Thanks for sharing such great information. It was really helpful to me. 카지노사이트

    ReplyDelete
  40. Your way of telling everything in this article is genuinely pleasant, all can easily understand it, Thanks a lot 카지노사이트

    ReplyDelete
  41. I want you to thank for your time of this wonderful read!!! 카지노사이트

    ReplyDelete
  42. Additionally, we recruit journalists in light of their certifications, permitting us to extend the general field specialty profundity! Having this variety permits clients to pay someone to write essay for me purchase articles and request any task that they could require from our quick paper composing administration; simply make certain to choose the most obviously qualified individual!

    ReplyDelete
  43. amazing slow downer License Key Amazing Slow Downer Crack is an easy-to-use Windows utility designed to help renee passnow Serial Key you play audio files in slow mode.beecut Activation Code Free It has a clean and intuitive GUI that gives users the ability macbooster license Key

    ReplyDelete
  44. This comment has been removed by the author.

    ReplyDelete
  45. TGM is a gaming macro that lets you have a macro mouse and keyboard functionally with ordinary one.tgm macro

    ReplyDelete

  46. This blog was… how do I say it? Relevant!!
    온라인바카라

    I am very happy to have found this site.
    홀덤사이트


    ReplyDelete
  47. IntroducingDealstaken, to make people feel better in shopping like ever beforehand, making it the greatest stage that holds purchase decisions through the power of save reserves. By partner assistants with our dynamic, involved shopping swarm, we widen the improvement for enormous number of brands in all over. We're happy to convey the most appealing extraordinary media game plans including strengthening coupons.

    ReplyDelete
  48. This comment has been removed by the author.

    ReplyDelete
  49. In the city of karachi the most expert clinic for the teeth dentist in karachi they are the expert in the our work and alot of patient are satisfied from this Dr.

    ReplyDelete
  50. I am pleased that I discovered this post, precisely the right info that I was looking for! Visit also Best T-Shirt Brands in USA

    ReplyDelete
  51. The worm spreads by exploiting vulnerabilities when a user visits certain Web pages. Exploit code hosted at these remote locations downloads the threat on to the compromised computer. Many of the infections are aided by users unwittingly clicking on malicious links.

    The worm also spreads through network shares by copying itself to shared folders when instructed to by a remote attacker.

    Reliable Permit Solutions, LLC

    ReplyDelete
  52. Cheers pertaining to expressing. I appreciate you writing this write-up and the rest of the website is very good. 카지노 토토사이트

    ReplyDelete
  53. looking to take actions to tackle Australians’ gambling spending. Commenting on the proposed creation
    토토

    ReplyDelete
  54. Nice Post. I have been reading here for about an hour. I am a newbie and your success is very much an inspiration for me.
    op auto clicker

    ReplyDelete
  55. You've provided quite good information here. Cannabis Clinic St Catharines This is fantastic since it expands our knowledge and is also beneficial to us. Thank you for sharing this piece of writing.

    ReplyDelete
  56. Follow for some viral news which are only for you. Get to know which are the upcoming top web series releasing in India. Know what are the trending topics going on in india. Get some viral news about web series , bollywood and all soughts if Indian stuff. upcoming web series hindi

    ReplyDelete
  57. I really like and appreciate your article.Really thank you! Keep writing.

    Abogado Tráfico Henrico VA

    ReplyDelete
  58. Exactly, the very information that I was looking for. I was looking for such kind of article on the Internet and finally ended up here. Thanks for the help! Traffic Lawyer Henrico Virginia

    ReplyDelete
  59. However, not all network marketing companies are created equal. Some are legitimate businesses with strong products and services, while others are nothing more than pyramid schemes that rely on recruiting new members to make money. Web N Shares

    ReplyDelete
  60. ajan spent nearly five years as vice president and head of engineering for Facebook in the Pacific Northwest Region. The company first opened an engineering center near Seattle in 2014 and has since grown to more than 7,000 employees in the region. GeekWire talked to Rajan last June before Facebook changed its name to Meta.

    “We are grateful for the considerable contributions Rajeev has made at Meta for nearly five years, leading our facebook login engineering function, as well as the Video and Entertainment teams,” Meta said in a statement provided to GeekWire. “We also thank Rajeev for leading the Pacific Northwest Meta offices. We wish him all the very best in his new chapter.”

    ReplyDelete
  61. I wanted to express my heartfelt appreciation for the valuable insights you shared in your post. Your content is not only helpful but also provides reliable information that I can rely on. Thank you so much for taking the time to create and share this wonderful post. Your contribution is truly appreciated
    divorcio en las leyes de nueva jersey

    ReplyDelete