Diary

 

new rogue-DHCP server malware
Share |
Published: 2009-03-16,
Last Updated: 2009-03-16 19:49:12 UTC
by Johannes Ullrich (Version: 1)
5 comment(s)

Thanks to Irwin for alerting us about a new version of rogue DHCP server malware he found in his network. The malware appears to be similar to Trojan.Flush.M which was found last December. Like back then, after infecting its target, the malware installs a rogue DHCP server. The main goal of the DHCP server is to spread a bad DNS server IP address.

Irwin did a good job comparing the two versions. Here is his summary of the differences:

  • The new version sets the DHCP lease time to 1 hour.
  • it sets the MAC destination to thebroadcast address, rather then the MAC address of the DHCP client
  • it does not specify a DNS Domain Name.
  • the options field does not contain an END option followed by PAD options.
  • Unlike Trojan.Flush.M, the BootP Broadcast Bit is set.

The malicious DNS server is 64.86.133.51 and 63.243.173.162.

Recommendation:

monitor connections to DNS servers other then the approved one pushed out by your DHCP server. This should help you spot this kind of malware. Yes, you can block the two IP addresses listed above, but it will likely do little good.

 

 

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute

Keywords: dhcp trojanflushm
5 comment(s)

Comments

Any update to this? How can it be identified (file, registry, etc)? I have quarantined a machine I believe to contain this malware, however I want to be certain.
posted by Green, Thu Mar 19 2009, 14:43
How would one monitor connections to DNS servers other then the approved one? A mirrored port and a sniffer? Wireshark? Educate us further please.
posted by Michael, Fri Mar 20 2009, 01:15
My advice is to use your own internal DNS servers, then block port 53 outbound from any computer on your network that is not a DNS server.

Most firewalls will allow for email alerts if a rule is triggered, this would be a great one to use that feature for. If any computer tries to get to a DNS server that isn't one of your internal ones, you'll know it is either infected, misconfigured, or someone is playing with nslookup.
posted by Jason, Mon Mar 23 2009, 18:22
To locate the invalid DHCP server, obtain a copy of the DHCP Server Locator Utility (DHCPLoc.exe) from Windows support tools.

These are included on OS install CDs (\Support\Tools).
http://technet.microsoft.com/en-us/library/cc758202.aspx

You can download XPs here (this .exe will work on Server 03 and Vista also):
http://www.microsoft.com/downloads/details.aspx?FamilyId=49AE8576-9BB9-4126-9761-BA8011FABF38&displaylang=en

DHCPLoc Overview:
http://technet.microsoft.com/en-us/library/cc778483.aspx

Syntax for this purpose:

dhcploc /p ThisComputerIPAddress ValidDHCPServerIP

The output will be:
Time (IP)ThisComputerIPAddress OfferedPacketType (S)DHCPServerIPAddressResponding [***]

[***] outputs if it detects an unauthorized server.

FYI - Symantec has write ups on earlier versions of this as Trojan.Flush.M and OSX.RSPlug.A
This newer variant (w/these new rouge DNS) is listed as W32.Tidserv.G (as a variant of W32.Tidserv)
http://www.symantec.com/security_response/writeup.jsp?docid=2009-032211-2952-99&tabid=2
posted by JamesL, Sat Apr 18 2009, 18:09
Let's try this again
<BR><BR>
To locate the invalid DHCP server, obtain a copy of the DHCP Server Locator Utility
(DHCPLoc.exe) from Windows support tools.<BR><BR>
These are included on OS install CDs (SupportTools).
http://technet.microsoft.com/en-us/library/cc758202.aspx
<BR><BR>
You can download XPs here which this exe will also work on server and vista too:
http://www.microsoft.com/downloads/details.aspx?FamilyId=49AE8576-9BB9-4126-9761-BA8011FABF38&displaylang=en
<BR><BR>
DHCPLoc Overview:
http://technet.microsoft.com/en-us/library/cc778483.aspx
<BR><BR>
Syntax for this purpose:
<BR><BR>
dhcploc /p ThisComputerIPAddress ValidDHCPServerIP
<BR><BR>
The output will be:
Time (IP)ThisComputerIPAddress OfferedPacketType (S)DHCPServerIPAddressResponding [***]
<BR><BR>
[***] outputs if it detects an unauthorized server.
<BR><BR>
FYI - Symantec has write ups on earlier versions of this as Trojan.Flush.M and OSX.RSPlug.A
This newer varient is listed as W32.Tidserv.G (as a variant of W32.Tidserv)
http://www.symantec.com/security_response/writeup.jsp?docid=2009-032211-2952-99&tabid=2
posted by JamesL, Sat Apr 18 2009, 18:11
Login here to post a comment. Diary Archive