Datamation Logo

Hackers Unleashing Code for Blaster Copycat

Home Security
By Sharon Gaudin
September 19, 2003
Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More .

Virus writers are reportedly sharing code online that will help them break into computers

and could lead to the creation of another Blaster-like worm, according to security experts.

The exploit code, which is making its rounds in the black-hat hacker underground, is the

source code that a programmer would use to create an administrative account on an infected

computer, giving the hacker control over that computer. The code takes advantage of the

latest flaws found in in Microsoft Corp.’s Windows operating system.

”The exploit code allows an attacker to create an administrative account and then he

literally owns that computer,” says Ken Dunham, malicious-code intelligence manager for

iDefense, Inc., a security company based in Reston, Va. ”Once he has access to that

computer, he can do whatever he wants. It’s trivial. With this exploit code it’s really easy

to do.”

Rachel Sunbarger, a spokeswoman for the Department of Homeland Security, told

Datamation that they are monitoring the situation and have been in contact with the

FBI, which handles high-tech investigations. ”This exploit code is definitely something

that we are watching,” she says.

Microsoft Corp. announced on Sep. 10 the existence of three recently found flaws in Windows

RPC protocols. Two of the flaws are eerily similar to the RPC vulnerability, discovered this

summer, that led to last month’s release of the Blaster worm, which quickly spread across

the world, clogging up corporate systems, sucking up bandwidth and ultimately trying to

launch a denial-of-service attack on a Microsoft Web site.

These new vulnerabilities include a Denial of Service flaw and two buffer overruns. The

flaws allow a remote attacker to take control of an infected computer, downloading files,

destroying information or using that computer to attack other computers.

Security experts have been on alert for a worm to hit that exploits the new vulnerabilities.

With the original Blaster code laying the developmental groundwork for the new attack, much

of the work already has been done.

Hacker Chatter

The appearance of this exploit code in the hacker community this week means virus

writers are even closer to developing that new worm. Several security experts say there has

been a ‘flurry’ of activity and chatter in the black-hat underground in the past two days.

”We have an elevated risk just because the code is out there,” says Dan Ingevaldson, an

engineering manager with Altanta-based Internet Security Systems, Inc. ”This seems to be

from the same group that wrote code that got into Blaster and Nachi. The group is called

XFocus. It’s a group of black-hat hackers out of China that has been producing exploits the

past few years.”

Ingevaldson, though, says the exploit code being shared isn’t extremely well-written

and may lead to more system crashes than compromises at this point.

But iDefense’s Dunham says the exploit code is already being used to hack into vulnerable

computers.

”One guy out there claims he’s already infecting computers,” says Dunham. ”I see no

reason why that couldn’t be true considering his history.”

Dunham, who first detected the sharing of the exploit code on Tuesday, knows the hacker’s

history and knows about the code because he infiltrated a private chat room dedicated to the

development of trojans.

”Someone who works on trojans long enough can work their way in,” says Dunham. ”This one

was not that difficult… There’s about a dozen or so guys who hang in the chat room trading

information. I was disguised as an individual who has an interest in trojans.”

Dunham says though he enters the chat room, he never shares code or promotes anything

malicious.

The code, Dunham notes, is specific to the Windows 2000 operating system. However, he adds

that he has evidence that virus writers are working on code for Windows NT and Windows XP

as well.

Security analysts say consumers and corporate IT managers are moving more quickly than usual

to download the needed patch for the latest RPC vulnerabilities. Memories of last month’s

costly Blaster and Sobig-F attacks are spurring on the precautions. The question is if the

millions of computers plagued by the flaws can be fixed before a worm is released.

”Microsoft reports that download of the patch is up 60% or so,” says Dunham.

”People are patching more aggressively, but there are thousand and thousands of computers

vulnerable. It’s going to take weeks before a large number of computers are patched.

”This code makes it very easy for someone to create a worm,” he adds. ”If you’ve got the

source code, which was made available Tuesday, you can go in and start doing a little bit of

programming and before you know it you’ve got a worm.”

Ingevaldson says he expects to see more exploit code and possibly the related worm hit in

the next week or so.

”There’s a lot of different people working on this,” says Ingevaldson. ”I’m expecting to

see at least a couple more variations of the exploit. First someone posts the exploit and

then someone else posts support for Windows NT to the exploit. Then someone else fixes a bug

in the exploit. Once it hits critical mass — once it’s effective — all it takes is one

person to write some code, maybe a few hundred lines to require targets and compromise them.

It’s impossible to predict because all it takes is one person to do it.”

  SEE ALL
ARTICLES  
Previous Article
Virus Poses as Microsoft Security Patch
Next Article
CA World: Storage a Major Focus, Part 1

Subscribe to Data Insider

Learn the latest news and best practices about data science, big data analytics, artificial intelligence, data security, and more.

Similar articles

thumbnail AI in Cybersecurity: The Comprehensive Guide to Modern Security

AI in Cybersecurity: The Comprehensive Guide to Modern Security

AI
thumbnail What Is Cybersecurity? Definitions, Practices, Threats

What Is Cybersecurity? Definitions, Practices, Threats

Security
thumbnail How to Secure a Network: 9 Key Actions to Secure Your Data

How to Secure a Network: 9 Key Actions to Secure Your Data

Security
Datamation Logo

Datamation is the leading industry resource for B2B data professionals and technology buyers. Datamation's focus is on providing insight into the latest trends and innovation in AI, data security, big data, and more, along with in-depth product recommendations and comparisons. More than 1.7M users gain insight and guidance from Datamation every year.

Advertisers

Advertise with TechnologyAdvice on Datamation and our other data and technology-focused platforms.

Advertise with Us

Our Brands

Technologyadvice
ServerWatch
TechRepublic
Enterprise Networking Planet
eWeek
Project Management
eSecurity Planet
IT Business Edge
Privacy Policy Terms & Conditions About Contact Advertise California - Do Not Sell My Information

Property of TechnologyAdvice.
© 2025 TechnologyAdvice. All Rights Reserved

Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.