News

Bot the Likely Culprit for WINS Flaw Activity

There was a flurry of discussion regarding a possible WINS worm due to a spike in WINS port 42 traffic.

The vulnerability arises from a problem with the Microsoft Windows Internet Naming Service. Microsoft posted a patch on Dec. 14 for the flaw, which was unusual in that it was already public. Most Microsoft patches serve as the first indication outside of Microsoft and a single security firm or researcher that the patched flaws exist.

Since the vulnerability is only found in WINS servers, not WINS clients, and since WINS servers are few and far between, we quickly surmised that one or more of the current bots had included the recently published exploit and started scanning for it.

Anyone with such a bot already installed would then emit the attack packets.

A bot is any piece of software which makes a victim system behave like a robot. Once the software is executed, it causes the system to take instructions from the bot owner.

This is typically done via an IRC channel. The bot, when started, registers itself to the bot owner as part of that person's botHerd. A botHerd is simply the name given to a group of similar bots under the control of a single owner, or group of owners.

By establishing an outbound connection to the bot IRC channel, bots can bypass many firewalls or similar controls where outbound traffic is, unfortunately, typically allowed.

Bots are notorious for quickly implementing new vulnerability exploit code, and since the botHerd owners have an established base of attacking systems, the attack can easily look like a worm.

An instruction is issued in the controlling IRC channel and the bots dutifully update themselves with whatever new attacks the bot owner has coded. Then they'll typically resume their activities, be it spamming, attacking or whatever the owner desires.

Russ Cooper is a Senior Information Security Analyst with Cybertrust, Inc., www.cybertrust.com. He's also founder and editor of NTBugtraq, www.ntbugtraq.com, one of the industry's most influential mailing lists dedicated to Microsoft security. One of the world's most- recognized security experts, he's often quoted by major media outlets on security issues.

Russ Cooper's Security Watch column appears every Monday in the Redmond magazine/ENT Security Watch e-mail newsletter. Click here to subscribe.

About the Author

Russ Cooper is a senior information security analyst with Verizon Business, Inc. He's also founder and editor of NTBugtraq, www.ntbugtraq.com, one of the industry's most influential mailing lists dedicated to Microsoft security. One of the world's most-recognized security experts, he's often quoted by major media outlets on security issues.

Featured

  • Microsoft Appoints Althoff as New CEO for Commercial Business

    Microsoft CEO and chairman Satya Nadella on Wednesday announced the promotion of Judson Althoff to CEO of the company's commercial business, presenting the move as a response to the dramatic industrywide shifts caused by AI.

  • Broadcom Revamps VMware Partner Program Again

    Broadcom recently announced a significant update regarding its VMware Cloud Service Provider (VCSP) program, coinciding with the release of VMware Cloud Foundation (VCF) 9.0, a key component in Broadcom’s private cloud strategy.

  • Closeup of the new Copilot keyboard key

    Microsoft Updates Copilot To Add Context-Sensitive Agents to Teams, SharePoint

    Microsoft has rolled out a new public preview for collaborative "always on" agents in Microsoft 365 Copilot, bringing enhanced, context-aware tools into Teams channels, meetings, SharePoint sites, Planner workstreams and Viva Engage communities.

  • Windows 365 Cloud Apps Now Available for Public Preview

    Microsoft announced this week that Windows 365 Cloud Apps are now available for public preview. This aims to allow IT administrators to stream individual Windows applications from the cloud, removing the need to assign Cloud PCs to every user.