Subj : Bugbear.A virus notes
To   : David Noon
From : Mike Luther
Date : Fri Oct 04 2002 12:40 am

Yes Dave..

 DN> According to that report, the virus requires M$ Lookout (or a user who 
 DN> is as brain-dead as Lookout) to be activated, as it is 
 DN> transported as a mail attachment. The mail message is 
 DN> the Trojan, I suppose. The size of the executable 
 DN> attachment is always 50,688 bytes. [A "virus" the size 
 DN> of an elephant!]

 DN> Unless you are running Lookout, there should be no 
 DN> real threat to an OS/2 box. [Assuming the BBC is 
 DN> correct.]

I understand that the virus cannot be ACTIVATED.  What I also saw with this 
same port 137 and 139 port ramp up with NIMDA.A here is different, in a way. 
The inbound probes to look for a penetratable box on the port 137/139 sequence 
*CAN* result in dropping file onto the OS/2 box from afar *IF* the NETBIOS over 
OS/2 protocol is installed on the system and *IF* the initial probe is able to 
establish how to write to a shared resource on it.

I absolutely agree that the virus cannot, as we understand it is recorded to 
operate, execute on the OS/2 box at all.

The point is that NIMDA.A, a similar sort of approach, before the entire attack 
profile of the creation was propagated, *WAS* able to download READ.ME and so 
on actually into the OS/2 box into various directories.

The fact that it is transported as a mail attachment isn't all of the story as 
in the above.  George Vandervort's Fido post for his protective vendor outlined 
more of the story than is noted by either you or Peter.  It was the one which 
made the comparison on the Port 137/139 Netbios access method and the previous 
NIMDA.A use of the same techniques.

In that I've personally seen that approach compromise an OS/2 only box to the 
extent that it loaded the required files remotely onto it not once but twice, I 
posted the original message.

I've further seen this same approach here, when the penetration attempt also 
adds JAVA to the messaging mechanism, actually start a message window in an 
attempt on an OS/2 box to execute the Trojan.  But of course, the Trojan won't 
run in OS/2.  The way the loaded message deal works is that the screen 
placement for the pure white 'empty' box for that message is made very tiny in 
size.  In this case, it was deliberately skewed down to the very lower right 
corner of my OS/2 desktop.  Only the tiny upper left hand corner of the bogus 
message opening JAVA attempt could be seen, the little close me box button you 
usually see to close the window.  It simply got stuck there,in that it couldn't 
execute the payload.  But it was able to TRY to do so,even in OS/2.

If you will think a little bit about the possibility of being able to even just 
upload a file to any OS/2 box, it ought to give you pause to ponder. At that 
point any executable which will execute in DOS can be a problem, or any in 
OS/2, or any FAMILY mode program as well.   OS/2 is not at all free of 
potential problems under this approach.


--> Sleep well; OS/2's still awake! ;)

Mike @ 1:117/3001

--- Maximus/2 3.01
 * Origin: Ziplog Public Port (1:117/3001)

.