Analysis on NIMDA Worm in Windows | Exploitation | Detection | Propagation

Hello!
I am Gayan Weerarathna
Lets get started with todays presentation… 😉😉
2

CONTENT
1). Introduction
2). Propagations
3). Exploitation
4). Detection
5). Eradication
6). Protection
7). Recommendations
8). References
3

Weekly Roadmap
4
1 3 5
6
4
2
Introduction Exploitation Protection
Propagations Detection Conclusion

What is NIMDA ?
1
 NIMDA which is the backword spelling of word
“ADMIN”
 It is a malicious file infection computer warm that
got infected to Windows IIS servers and Internet
Explorer and made them weak
 Occurred in 18th of September 2001

What is NIMDA ?
1
1. Uses commands that trick the targeted
program into granting access
2. Worst case scenario – reformatting of
affected disks + program reinstallation
3. Mainly takes advantage of
• out-of-date MS applications on networked computers
• servers with vulnerable Internet Information Service (IIS)
• PCs running vulnerable Internet Explorer (IE)

1. User may have read, write, connect, delete, and execute
privileges on any file system
2. It depends on configuration established by the sys
admin
3. A share with no password = successful infection
4. Makes multiple MIME-encoded duplicates
10
1) Windows Shares

1. First, check for previous infections of
"Code Red II" worm
2. Second, check for Microsoft exploits that
Nimda uses.
3. User infection
11
2) Web

Use MAPI service to collect email addresses from infected
machines
Then send emails with attachment called “readme.exe”
Any vulnerable IE user can be infected by that attachment
Email Propagation characteristics:
◇ Variable mail subject
◇ Closely 57344 (bytes) size attachment
12
3) Email

What can Attacker Do
after Compromising
Your System?
3
1. Passwords can be stolen or changed
2. Placing keystroke-logging software in your device
3. Reconfiguration of Firewall rules
4. Sending harmful content using victim`s e-mail
address

CVEs related to Nimda
3
1. "Web Server Folder Traversal" vulnerability
(CVE- -2000-0884)
2. "Directory Traversal" vulnerability (CVE--
2001- 0333)
3. "MIME Attachment Execution" (CVE- 2001—
0154)
4. "Office 2000 dll Execution“ (CVE--2000-
0854)

Signs of Infection
4
1. root.exe file
2. string like: [/c+tftp percent 20- I percent
20x.x.x.x percent 20GET percent 20Admin.dll
percent 20d:Admin.dll] inside the IIS logs
3. Admin.dll file inside any root folders
4. .nws / .eml files in multiple directories

Signatures
4
 web server logs contain the following signatures

5
1. All the identifies systems were entirely
rebuilt or fixed
2. Some infected servers kept sending infection
techniques to others
3. Systems were rebuilt using an Windows NT
4.0 SP3 image which seems to be much
reliable in this case
4. Immediately after the infection all the
necessary systems were quarantined.

6
1. Awareness
2. Scale up your network should be parallel with its
security also
3. On both servers and workstations, virus
identification software all should be kept up to
date
4. Implement a mission critical backup process
5. Approved and trusted virus protection for all the
platforms and OS
6. Make it a habit for everyone to follow security
best practices

6
 Operating Systems
Microsoft Windows 95
Microsoft Windows ME
Microsoft Windows 98
Microsoft Windows NT
Microsoft Windows 2000 workstation
 Protocols
HTTP
ARP
SMTP
TFTP
SMB
TCP/IP
Key Aspect Involved

6
 Applications
Internet Explorer
Windows Explorer
Outlook
 Services
Microsoft IIS 4.0
MAPI
Microsoft IIS 5.0
Net BIOS
Key Aspect Involved

For Network Admins
7
 Ingress filtering
• Must be used to prevent externally started
inbound connection(s) to unauthorized services at
the boundary.
• Only device that need the allow inbound
connections are, severs.
• Port 80/TCP >> can stop copies of NIMDA
• Filtering ports 69/UDP >> can stop the worm
from being downloaded to IIS using TFTP

For Network Admins
7
 Egress filtering
• Outbound connections towards the Internet
are required by machines offering public
services
• Port 69/UDP >> can restrict certain
components of the worm's spread

For End User Systems
7
1. Keep using a reliable Antivirus Product
2. Disable Java Scripts
3. Do NOT open suspicious attachments in e-
mails
4. Use the patch provided by your vendor

8
References
1. C. M. University, “resources.sei.cmu.edu,” 12 2001. [Online].
Available:
https://resources.sei.cmu.edu/library/assetview.cfm?assetID=49
6190
2. cve.mitre.org, “CVE,” [Online]. Available:
http://cve.mitre.org/cgibin/cvename.cgi?name=CVE-2000-0884
6. R. Lemos, “ZDNET,” 19 09 2001. [Online]. Available:
https://www.zdnet.com/article/helpand-howto-nimda/

9
Methodology
The goal of this research is to understand
more about the NIMDA Worm: Exploitation,
Detection, and Propagation in Windows. The
research for this topic was conducted using a
Google survey, websites, books, academic
studies, research papers and lectures. Using all
of the aforementioned sources, I acquired the
required data and analytics for my study.

10
Conclusion
The core idea behind NIMDA's findings is that it will
weaken the system's confidentiality, exposing it to
future attacks by making it susceptible through file
changes. Furthermore, this warm attack has
resulted in a significant amount of unavailability in
the target systems. NIMDA uses a variety of
propagation techniques, including email
propagation, Windows share propagation and Web
propagation. Other than the major themes, this
research report also covers subtopics such as
NIMDA eradication, how to guard against NIMDA,
and expert suggestions/recommendation om how
to protect from NIMDA.

Analysis on NIMDA Worm in Windows | Exploitation | Detection | Propagation

More Related Content

Similar to Analysis on NIMDA Worm in Windows | Exploitation | Detection | Propagation (20)

Recently uploaded (20)

Analysis on NIMDA Worm in Windows | Exploitation | Detection | Propagation

Editor's Notes