White Papers White Papers
CERT® Incident Note IN-2001-13: Kaiten Malicious Code a/k/a W32/Voyager, Voyager Alpha Force, W32/CBlade.Worm, Installed by Exploiting Null Default Passwords in MS-SQL
Overview
Release Date: November 27, 2001
Systems Affected:
- Systems running Microsoft SQL Server (MS SQL) or Microsoft SQL 2000 Server (SQL 2000) installed with mixed mode security enabled
-Systems running Microsoft Data Engine (MSDE) installed with mixed mode security enabled
-Systems running Tumbleweed's Secure Mail (MMS) versions 4.3, 4.5, and 4.6
Overview:
The CERT/CC has received reports of a new variant of the Kaiten malicious code being installed through exploitation of null default sa passwords in Microsoft SQL Server and Microsoft Data Engine. (Microsoft SQL 2000 Server will allow a null sa password to be used, but this is not default behavior.) Various sources have referred to this malicious code as W32/Voyager, Voyager Alpha Force, and W32/CBlade.worm.
Description: "Kaiten" made its initial appearance in August 2001 and is based on the "Knight" distributed attack tool mentioned in CA-2001-20 Continuing Threats to Home Users.
In reports received by the CERT/CC, installation of "Kaiten" was preceded by scans for hosts listening on 1433/tcp (MS-SQL). The infection process leverages sa accounts with null passwords to gain access to vulnerable systems. It then uses the xp_cmdshell stored procedure to initiate an FTP session from the victim system to a remote site. A copy of "Kaiten" is then downloaded and executed on the victim system.
Once the "Kaiten" code has begun execution on the victim system, it connects to an IRC server (on port 6667/tcp or 6669/tcp, according to reports received by the CERT/CC) to await further commands from the attacker. The attacker can then remotely issue commands to multiple compromised systems simultaneously, allowing compromised hosts to be used as DDoS agents, port scanners, etc. The attacker can also remotely reconfigure "Kaiten" via IRC to modify certain settings, including the IRC servers and channels it connects to.
At least three variants of "Kaiten" have been f
| Publisher | CERT Coordination Center | File Format | HTML |
|---|---|---|---|
| Date Published | November 2001 | Downloads | 3 |
| Format | White Papers | ||
| Topics |
|
||
-
Did you find this white paper useful?
White Paper RSSBuilding a Hybrid Data Warehouse Model
DownloadThis paper discusses the hybrid design and provides a fully functional reference implementation. The system runs on Oracle Database 10g. It contains all code needed to build the database schemas,...
Balancing Security Against Productivity
What makes for great security? Is it about keeping the bad guys out or letting the good guys in? About defending attacks or preventing them? When IDG Research Services queried...
Automation for the New Data Center
Is your data centre being squeezed by increasing power and cooling costs? Are your servers underutilised and costly to manage? Virtualization enables data center managers to make far better use...
Database Consolidation Makes New IT Initiatives Possible
The Issue: The proliferation of databases is Preventing money and staff from being devoted to new IT initiatives.Read this recent AMR Research survey which found that companies are reducing the...
The Benefits for Growing and Mid-Sized Businesses of a Having One Integrated Business Management Software Suite
Overcoming the barriers of stand-alone business applications is a major challenge to growth for companies worldwide. Learn how an expanding organization can better gain control of its business operations and...
