new rogue-DHCP server malware
Thanks to Irwin for alerting us about a new version of rogue DHCP server malware he found in his network. The malware appears to be similar to Trojan.Flush.M which was found last December. Like back then, after infecting its target, the malware installs a rogue DHCP server. The main goal of the DHCP server is to spread a bad DNS server IP address.
Irwin did a good job comparing the two versions. Here is his summary of the differences:
- The new version sets the DHCP lease time to 1 hour.
- it sets the MAC destination to thebroadcast address, rather then the MAC address of the DHCP client
- it does not specify a DNS Domain Name.
- the options field does not contain an END option followed by PAD options.
- Unlike Trojan.Flush.M, the BootP Broadcast Bit is set.
The malicious DNS server is 64.86.133.51 and 63.243.173.162.
Recommendation:
monitor connections to DNS servers other then the approved one pushed out by your DHCP server. This should help you spot this kind of malware. Yes, you can block the two IP addresses listed above, but it will likely do little good.
------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
| Application Security: Securing Web Apps, APIs, and Microservices | Washington | Dec 13th - Dec 18th 2024 |
Comments
Green
Mar 19th 2009
1 decade ago
Michael
Mar 20th 2009
1 decade ago
Most firewalls will allow for email alerts if a rule is triggered, this would be a great one to use that feature for. If any computer tries to get to a DNS server that isn't one of your internal ones, you'll know it is either infected, misconfigured, or someone is playing with nslookup.
Jason
Mar 23rd 2009
1 decade ago
These are included on OS install CDs (\\Support\\Tools).
http://technet.microsoft.com/en-us/library/cc758202.aspx
You can download XPs here (this .exe will work on Server 03 and Vista also):
http://www.microsoft.com/downloads/details.aspx?FamilyId=49AE8576-9BB9-4126-9761-BA8011FABF38&displaylang=en
DHCPLoc Overview:
http://technet.microsoft.com/en-us/library/cc778483.aspx
Syntax for this purpose:
dhcploc /p ThisComputerIPAddress ValidDHCPServerIP
The output will be:
Time (IP)ThisComputerIPAddress OfferedPacketType (S)DHCPServerIPAddressResponding [***]
[***] outputs if it detects an unauthorized server.
FYI - Symantec has write ups on earlier versions of this as Trojan.Flush.M and OSX.RSPlug.A
This newer variant (w/these new rouge DNS) is listed as W32.Tidserv.G (as a variant of W32.Tidserv)
http://www.symantec.com/security_response/writeup.jsp?docid=2009-032211-2952-99&tabid=2
JamesL
Apr 18th 2009
1 decade ago
<BR><BR>
To locate the invalid DHCP server, obtain a copy of the DHCP Server Locator Utility
(DHCPLoc.exe) from Windows support tools.<BR><BR>
These are included on OS install CDs (SupportTools).
http://technet.microsoft.com/en-us/library/cc758202.aspx
<BR><BR>
You can download XPs here which this exe will also work on server and vista too:
http://www.microsoft.com/downloads/details.aspx?FamilyId=49AE8576-9BB9-4126-9761-BA8011FABF38&displaylang=en
<BR><BR>
DHCPLoc Overview:
http://technet.microsoft.com/en-us/library/cc778483.aspx
<BR><BR>
Syntax for this purpose:
<BR><BR>
dhcploc /p ThisComputerIPAddress ValidDHCPServerIP
<BR><BR>
The output will be:
Time (IP)ThisComputerIPAddress OfferedPacketType (S)DHCPServerIPAddressResponding [***]
<BR><BR>
[***] outputs if it detects an unauthorized server.
<BR><BR>
FYI - Symantec has write ups on earlier versions of this as Trojan.Flush.M and OSX.RSPlug.A
This newer varient is listed as W32.Tidserv.G (as a variant of W32.Tidserv)
http://www.symantec.com/security_response/writeup.jsp?docid=2009-032211-2952-99&tabid=2
JamesL
Apr 18th 2009
1 decade ago