Nachi, the latest worm to hit the Internet, had Cisco Systems Inc. on Wednesday posting information on its Web site informing customers as to which ports the bug could potentially attack.
Cisco said TCP and User Datagram Protocol (UDP) ports 137, 138, 139 and 593 have vulnerabilities but are not currently known to be directly associated with the spreading of Nachi. The company did however confirm the vulnerability associated with TCP port 135.
Nachi propagates through the TCP port 135 on Microsoft Corp.’s Windows XP and 2000 machines that have not been patched against Microsoft’s Windows Distributed Component Object Model (DCOM) Remote Procedure Call (RPC) interface buffer overrun vulnerability.
It may not be spreading as rapidly as its predecessor, but the worm known as Nachi is using the same ports as Blaster to infect systems. And, according to one security specialist, the latest Internet-transmitted bug has one unique characteristic that sets it apart from other worms.
Russ Cooper, surgeon general for TruSecure Corp. in Lindsay, Ont., said Nachi attacks the same machines or systems, which are vulnerable to Blaster. Once on a system, Nachi attempts to download the DCOM RPC patch from Microsoft’s Windows Update Web site and installs the patch. He explained that the downloading of the patch makes this bug “entirely unique.”
Coupled with its aggressive scanning technique, Cooper said Nachi makes the process of trying to download the patch “self defeating” because with the network bogged down by the worm as it creates network scanning traffic, it becomes nearly impossible for a machine to actually download the patch.
“The patch download was merely an attempt by the author to try and make it look like a do-gooder worm when in reality, the author’s intention was to try and crash entire networks by virtue of its scanning traffic,” he said.
The worm also uses the trial file transport protocol (TFTP) to copy files from the attacker’s computer to the victim’s system and once the patch is applied, Nachi then causes the victim’s machine to look for new systems to hit.
Nachi showed Air Canada what damage it could do Tuesday by forcing the national airline to delay and cancel some flights when the worm hit its system. This forced Air Canada to check passengers in manually nationwide. The airline has since patched the problem and said it is essentially back to normal business.
