Uechi-Ryu.com

This virus caused a bit of a stir here on my machine and in my company (because nobody had seen it before) until everyone realized I hadn't released the payload. I got this suspicious-looking e-mail a few weeks ago, and basically saved it rather than open it. Symantec hadn't even known of its existence at the time I got the e-mail. Fortunately - for a number of good reasons - I never opened the attachment and triggered the virus. Yesterday the company updated my Norton virus files, and my daily machine scan found the unexecuted virus in my saved file.

The e-mail contained an attachment labeled "26705-i386-update.exe". This is what Symantec says about it.

http://service1.symantec.com/sarc/sarc.nsf/html/PWSteal.Coced240b.Tro.html

This is what the e-mail looked like <BLOCKQUOTE><font size="1" face="Verdana, Arial">quote:</font><HR>From: support@microsoft.com
Sent: Monday, February 12, 2001 5:17 AM
To: **********
Subject: New critical update
Microsoft Security Bulletin (MS01-001)
Patch Available for "Web Client NTLM Authentication" Vulnerability

Originally posted: January 11, 2001

Summary
Microsoft has released a patch that eliminates a security vulnerability in a
component that ships with Microsoft® Office 2000, Windows 2000, and Windows
Me. The vulnerability could, under certain circumstances, allow a malicious user
to obtain cryptographically protected logon credentials from another user when
requesting an Office document from a web server.
Frequently asked questions regarding this vulnerability and the patch can be
found at http://www.microsoft.com/technet/security/bulletin/fq01-001.asp

Issue
The Web Extender Client (WEC) is a component that ships as part of Office 2000,
Windows 2000, and Windows Me. WEC allows IE to view and publish files via
web folders, similar to viewing and adding files in a directory through Windows
Explorer. Due to an implementation flaw, WEC does not respect the IE Security
settings regarding when NTLM authentication will be performed - instead, WEC
will perform NTLM authentication with any server that requests it. If a user
established a session with a malicious user’s web site - either by browsing to
the site or by opening an HTML mail that initiated a session with it - an
application on the site could capture the user’s NTLM credentials. The malicious
user could then use an offline brute force attack to derive the password or, with
specialized tools, could submit a variant of these credentials in an attempt to
access protected resources.
The vulnerability would only provide the malicious user with the
cryptographically protected NTLM authentication credentials of another user. It
would not, by itself, allow a malicious user to gain control of another user’s
computer or to gain access to resources to which that user was authorized
access. In order to leverage the NTLM credentials (or a subsequently cracked
password), the malicious user would have to be able to remotely logon to the
target system. However, best practices dictate that remote logon services be
blocked at border devices, and if these practices were followed, they would
prevent an attacker from using the credentials to logon to the target system.

Affected Software Versions
Microsoft Office 2000
Microsoft Windows 2000
Microsoft Windows Me
Patch Availability
Microsoft Office 2000 (All Platforms): http://officeupdate.microsoft.com/2000/downloaddetails/wecsec.htm
Microsoft Windows 2000 (Without Office 2000): http://www.microsoft.com/Downloads/Release.asp?ReleaseID=26889
Microsoft Windows Me (Without Office 2000): http://www.microsoft.com/Downloads/Release.asp?ReleaseID=26705
Note: Since the affected component ships with the above products independent of
Office 2000, we have provided patches for affected systems that may not be
running Office 2000. As discussed in the FAQ, the patch and vulnerability only
affect machines running Internet Explorer 5.0 or later with Web Folders enabled.

Note: This patch will be included in Windows 2000 Service Pack 2.

Note Additional security patches are available at the Microsoft Download Center

More Information
Please see the following references for more information related to this issue.

Frequently Asked Questions: Microsoft Security Bulletin MS01-001, http://www.microsoft.com/technet/security/bulletin/fq01-001.asp
Microsoft Knowledge Base article Q282132, http://www.microsoft.com/technet/support/kb.asp?ID=282132
Microsoft TechNet Security web site, http://www.microsoft.com/technet/security/default.asp
Obtaining Support on this Issue
This is a fully supported patch. Information on contacting Microsoft Product
Support Services is available at http://support.microsoft.com/support/contact/default.asp.

Acknowledgments
Microsoft thanks the following people for working with us to protect customers:

David Litchfield of @stake.
Matt Scarborough (matt.scarborough@gte.net)
Revisions
January 11, 2001: Bulletin Created.
January 15, 2001: Correction to Acknowledgement section.
THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS
BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT,
INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL
DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN
ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT
ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL
OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.<HR></BLOCKQUOTE>

- Bill

Hmmm.... I was even able to open on the line in your post. Maybe Symantec only allows you access if you have the Norton antivirus installed.

Here is the first part of the post - enough to give you an idea. <BLOCKQUOTE><font size="1" face="Verdana, Arial">quote:</font><HR>PWSteal.Coced240b.Tro
Discovered on: February 16, 2001
Last Updated on: February 28, 2001 at 07:02:32 PM PST

The password stealer appears as an attachment named 26705-i386-update.exe. It claims to be a vulnernability patch that is mailed from support@microsoft.com. The Trojan sends confidential password information to an email address.

Microsoft has posted information regarding bogus files such as this at:
http://www.microsoft.com/technet/security/bogus.asp

Also Known As: Trojan.PWS.Coced.240.b, PWS.gen, NAEBI.240B.Trojan<HR></BLOCKQUOTE>

- Bill

Norton is installed here. The link on my repost is the link you placed on yours after I retrieved it in full from the Address line of I.E.

Tried again w/o success. There could be a number of other reasons for this, including internal security, etc., but I'll try from another site later today; it is important to keep abreast of latest developments.

One can never be too careful when opening attachments to his email. Hey Bill, I've got this nifty word document here. What's youtr email address again?

------------------
Allen Moulton from Uechi-ryu Etcetera

ASIDE: What has been concerning me greatly lately is the increased number of web-page-style email documents I have been receiving. I normally keep Active-X and cookies turned off and get reports of "unable to open Active-X". So I think and do: "Sure. Like my friends don't send active-X, so whomever you are and what you've got I don't want. ZAP-O, in the bit bucket you go"

Active-X PLUS something coming in automatically depositing a DLL or two in your system32 folder are two things to be concerned about.

[This message has been edited by Allen M. (edited March 08, 2001).]

Yea...and I've got the Dallas Cowboy Cheerleaders on the phone asking to have my children.

The wierd thing is the e-mail address it was sent to. It's a vanity address I don't use very often. It narrows down the sources considerably. Interesting...

- Bill

Link works perfectly from here, Bill.

Looks like getting out regedit to do a search once in a while is not a bad thing.

------------------
Allen Moulton from Uechi-ryu Etcetera

I got that one too, I think it was the same day Gary got his. I forwarded mine to InoculateIT and it was new to them also.

Getting the infamous "The page cannot be displayed" message when I attempt to open

http://service1.symantec.com/sarc/sarc.nsf/html/PWSteal.Coced240b.Tro.html , Bill