MCI Telecommunications internetMCI Security Group Report Name: iMCI Security Alert - WinNT Widespread Teardrop Exploit Report Number: iMCISE:IMCI:030398:01:P1R1 Report Date: 03/03/98 Report Format: InFormal Report Classification: MCI Informational Report Reference: http://www.security.mci.net ------------------------------------------------------------------------ MCI has received confirmation of an ongoing, widespread attack specifically targeting Internet connected WindowsNT systems. We are providing this data in an effort to alert you to these attacks, and to possibly provide a protection mechanism against them. This exploit appears to be a variation of the TearDrop (http://www.microsoft.com/security) attack that has effected Win95 and WinNT machines in the past. Patches for this appear to be available at; ftp://ftp.microsoft.com/bussys/winnt/winntpublic/fixes/usa/nt40/hotfixes-pos tSP3/teardrop2-fix/Q179129.txt ftp://ftp.microsoft.com/bussys/winnt/winntpublic/fixes/usa/nt40/hotfixes-pos tSP3/teardrop2-fix/README.TXT for intel ftp://ftp.microsoft.com/bussys/winnt/winntpublic/fixes/usa/nt40/hotfixes-pos tSP3/teardrop2-fix/tearfixi.exe for alpha ftp://ftp.microsoft.com/bussys/winnt/winntpublic/fixes/usa/nt40/hotfixes-pos tSP3/teardrop2-fix/tearfixa.exe The attacks appear to be automated and coming from multiple sources, sweeping specific systems within a customer's network. (eg; possibly obtaining a list of systems via DNS tables, then attacking found systems). You may want to take measures to have your Intrusion Detection systems look for sequential DNS lookups of your netblocks. Source addresses of the attack have been forged, one address that has been used in previous attacks is 199.0.154.13 - although that address could be changed at any time, since the address is a forged, invalid address. Source ports of the attack, thus far, has been tcp port 4000. Although that port could be changed at any time as well. The attack appears to be focused on .gov and .edu sites, although some commercial sites have registered complaints. Should you have any questions, please feel free to contact myself or MCI's Incident Response Team at "security@mci.net". NT, and Microsoft, Security issues can be obtained at; http://www.microsoft.com/security http://listserv.ntbugtraq.com/archives/index.html SUCCESS THROUGH TEAMWORK ================================================================