madison
Home / News & Blogs

Microsoft server worm can spread via USB

Tom Espiner ZDNet.co.uk | January 8, 2009 5:57 AM PST

Summary

A Windows Server worm that is attacking business systems also propagates via USB, says F-Secure.

Topics

Server, Microsoft Corp., F-Secure Corp., USB, Cyberthreats, Viruses And Worms, Microsoft, worm, security, F-Secure, CERT, Downadup, Tom Espiner ZDNet.co.uk
A Microsoft worm that is currently attacking business systems is also a USB worm, security vendor F-Secure has warned.

The worm, which F-Secure calls Downadup, attacks the vulnerability outlined in MS08-067, a Windows Server service flaw that was patched in October.

The worm launches a dictionary attack to attempt to crack user passwords, and uses server-side polymorphism and modification to the Access Control Lists (ACL) "to make network disinfection particularly difficult", F-Secure said in a blog post on Tuesday.

However, F-Secure said it has discovered the worm also propagates on the client side, via USB. If a person plugs a USB stick into an infected computer, the malware creates an autorun.inf file on the root of the USB drive.

The .inf file then uses either autorun or autoplay to infect any unpatched systems either when the stick is plugged into the system, or when the user double-clicks on the USB icon in My Computer in Windows Explorer.

The USB worm uses a steganographic technique to hide the autorun file in "binary garbage" to make detection more difficult, said F-Secure's chief research officer Mikko Hyppönen in a blog post on Wednesday.

The US Computer Emergency Response Team has urged IT professionals to apply the patch linked to in MS08-067.

ZDNet UK reader gareth25, who describes himself as an IT consultant from Manchester, said he has had to deal with systems infected by this worm. "I have first hand experience with this worm," wrote gareth25 in a response to a ZDNet UK story. "The connections it made outbound crashed the firewall and brought the internet down constantly. It's not exactly a one click removal either. Please patch your systems now."

Talkback Most Recent of 12 Talkback(s)

Talkback - Tell Us What You Think

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity