Security Experts Tracking New Sasser Variant

With two variants of the Sasser worm already infecting computers through a recent vulnerability in Windows, security experts now are tracking a third version of the worm and an exploit that attacks the same flaw.

Sasser.C is closely related to the two earlier versions of the worm, except for the fact that it spawns 1024 threads on infected systems—nearly 10 times the number created by Sasser and Sasser.B.

There also is a separate piece of code that attacks the weakness in Windows LSASS (Local Security Authority Subsystem Service) component; it is a tool that generates traffic that closely resembles that of the Sasser worms. However, the tool only generates traffic on port 445, and does not attempt any FTP connections to the machine it is attacking. The tool also does not try to communicate over ports 5554 and 9996 the way that the worms do, according to an analysis of the exploit done by The SANS Institute, in Bethseda, Md.

The exploit also tries to learn the operating system type of the attacked PC and then send a shell back to a designated IP address. If this effort fails, the LSASS service crashes and the machine reboots.

SANS officials also said there have been reports of a major rise in ICMP traffic, which could be an indication of another worm in the wild.

The new attack code was discovered Sunday, two days after the first of the two Sasser worms appeared. Both versions of the worm can infect Windows 2000, XP and 2003 machines by exploiting the LSASS vulnerability, for which Microsoft Corp. released a patch last month. Once resident on a machine, Sasser starts an FTP server on port 5554 and uses port 445 to begin scanning for other machines to infect. Once it connects to another PC, the worm sends shell code to that machine and uses it to download a copy of the worm from the FTP server running on the infected machine.

Sasser starts 128 threads on each infected machine, gobbling up CPU resources and making many infected PCs all but useless, according to officials at Symantec Corp., in Cupertino, Calif.

Sasser.B, which appeared Sunday, is essentially the same as the original worm, except that it leaves a file named “avserve2.exe” on infected machines. Both worms have been spreading widely, although experts say that they are poorly written and unlikely to cause much damage.

/zimages/6/28571.gifCheck outeWEEK.coms Security Centerat http://security.eweek.com for security news, views and analysis.
Be sure to add our eWEEK.com security news feed to your RSS newsreader or My Yahoo page:http://us.i1.yimg.com/us.yimg.com/i/us/my/addtomyyahoo2.gif