From:	CRDGW2::CRDGW2::MRGATE::"SMTP::CRVAX.SRI.COM::RELAY-INFO-VAX" 19-OCT-1989 14:58
To:	MRGATE::"ARISIA::EVERHART"
Subj:	WANK DECNet Worm - Symptoms, Fixes & Antiworm Program

Received: From AMARNA.GSFC.NASA.GOV by CRVAX.SRI.COM with TCP; Thu, 19 OCT 89 06:48:48 PDT
Date:    Thu, 19 Oct 1989 9:50:16 EDT
From: FASTEDDY@AMARNA.GSFC.NASA.GOV   (John McMahon - NASA GSFC ADFTO - 301-286-2045)
Message-Id: <891019095016.2320015a@AMARNA.GSFC.NASA.GOV>
Subject: WANK DECNet Worm - Symptoms, Fixes & Antiworm Program
To: virus-l@ibm1.cc.lehigh.edu, valert-l@ibm1.cc.lehigh.edu, info-vax@sri.com
X-Vmsmail-To: SMTP%"virus-l@ibm1.cc.lehigh.edu",SMTP%"valert-l@ibm1.cc.lehigh.edu",SMTP%"info-vax@sri.com"

X-To: VIRUS-L@IBM1.CC.LEHIGH.EDU  (Virus program discussion list)
      VALERT-L@IBM1.CC.LEHIGH.EDU (Virus alert list)
      INFO-VAX@SRI.COM            (VAX discussion list)


The following information was distributed to System Managers at NASA Goddard
Space Flight Center about the WANK DECnet worm.  It contains a list of
symptoms, recovery procedures and an antiworm program.

Please direct any comments or questions to me (John McMahon) at the addresses
below.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

The WANK DECnet Worm:  Symptoms, Prevention & Recovery
======================================================

By John "Fast-Eddie" McMahon

Internet:	FASTEDDY@DFTNIC.GSFC.NASA.GOV
Span:		SDCDCL::FASTEDDY
Bitnet:		FASTEDDY@DFTBIT    
Phone:		(301) 286-2045 (alt. 286-9804)
                [FTS] 888-2045 (alt. 888-9804)

Network Support Group for Large Systems/Worm Response Team
Advanced Data Flow Technology Office - Code 630.4
NASA Goddard Space Flight Center
Greenbelt, Maryland 20771

October 18th, 1989


Preface:
--------

The following information covers several aspects of the "WANK" DECnet worm
which was released into the "World DECnet" (SPAN/HEPnet/etc) sometime prior to
October 17th, 1989.  This report covers three topics:

1) Visible Symptoms - A list of the symptoms that a VAX infected by the worm
   may have.

2) Recommended Actions - Techniques detailing how to clean up after an invasion
   by the worm.

3) ANTIWANK.COM - A program that kills the worm if it is running on your
   system, and that helps prevents new copies from running on your system.
   This program incorporates and extends the techniques developed by
   R. Kevin Oberman (DOE/LLNL) in his NETW_BLOCK routine.

This information was compiled after conducting a thorough analysis of copies of 
foure different versions  of the WANK DECnet worm.  These copies where
retrieved from different infected sites.  There are indications that these four
copies were derived from three different "starter" versions of the worm (The
worm is self-modifying).  There is a possibility that there are other versions
of the worm that have additional capabilities.

The analysis of the code has been separately documented and forwarded to SPAN
management.  The ADFTO will not (at this time) distribute the analysis or the
worm source code.


Visible Symptoms:
-----------------

1) Account passwords have been changed without the knowledge of the user,
   or the system manager.

2) Processes are running on your system with the process name NETW_nnnn.
   Check this with the SHOW SYSTEM command.

Visible Symptoms (continued):
-----------------------------

3) Command procedures/data file names starting with one or two letters and up 
   to a five digit number appear in the SYS$LOGIN: directory of an account.
   Examples: C12345.COM, A7007.DAT.

   Note: Earlier reports that the file W.COM is created by the worm
   appear to be in error.  Any "anti-worm" procedure involving the
   creation of a blank W.COM;32767 will NOT stop the worm.

4) The SYS$ANNOUNCE message, prior to the USERNAME: login prompt, has been 
   redefined to the following WANK logo.

      W O R M S    A G A I N S T    N U C L E A R    K I L L E R S
    _______________________________________________________________
    \__  ____________  _____    ________    ____  ____   __  _____/
     \ \ \    /\    / /    / /\ \       | \ \  | |    | | / /    /
      \ \ \  /  \  / /    / /__\ \      | |\ \ | |    | |/ /    /
       \ \ \/ /\ \/ /    / ______ \     | | \ \| |    | |\ \   /
        \_\  /__\  /____/ /______\ \____| |__\ | |____| |_\ \_/
         \___________________________________________________/
          \                                                 /
           \    Your System Has Been Officically WANKed    /
            \_____________________________________________/
 
     You talk of times of peace for all, and then prepare for war.
 
5) The SYSTEM account can no longer receive mail.  The DISMAIL flag has been
   set in SYSTEM's UAF record.

6) Users log into the system and report that all of their files have been
   deleted while logging in.  The user observes many %DELETE-I-FILDEL messages
   and DIRECTORY reports that no files are found.  The system manager follows
   up on this report and finds the files are still there, and that the system
   login procedure (SYLOGIN, SYS$SYLOGIN) has been modified.

   Note: Earlier reports that the worm performs mass deletion of files appears
   to be in error.

7) Command procedures have been modified with code to reactivate the FIELD
   account if the person running the procedure has SYSPRV.

8) A remote DECnet site contacts you about odd VAXPhone call messages coming
   from your node.  The VAXPhone ring messages do not contain a userid, but
   a strange "fortune cookie" saying.

   Note: If your site receives these phone calls, the source node information 
   can be found in the NETSERVER.LOG files in your DECnet default account.

9) Top-level directories have had their OWNER protection field changed to
   O:RWED.

10) A remote DECnet site contacts you about logfails (on several accounts) on 
    the remote site which were traced back to an account on your machine.
    Similarly, a remote site contacts you because a local account tried to 
    read the SYSUAF/RIGHTSLIST files on the remote node.


Recommended Actions for the Node System Manager to Take:
--------------------------------------------------------

1) Remove the TASK object from your list of DECnet objects by issuing the 
command MCR NCP CLEAR OBJECT TASK.  This will prevent the worm from entering
your system using the TASK object.  The worm will still try to enter using
the SUBMIT/REMOTE command.  We are still trying to find a simple, effective
block for that.

2) Enable security alarms for network accesses (especially breakin and logfail)
and modifications of the authorization file.  Enable system accounting.

3) If you have accounts that have the Password = Userid (Including the DECnet
default account) then they should be changed, or NETWORK access should be
removed from them.  Password = Null accounts are potentially at risk also.  

4) Regardless of whether or not you think you have been infected, extract the
ANTIWANK.COM command procedure at the end of this text and start it running on
your node immediately.  This program will kill copies of the worm that are
running on your node.  If you receive notification from the program (via mail)
that you are infected, NASA/GSFC sites should call the ADFTO at (301) 286-2045 
and forward the mail message to SDCDCL::FASTEDDY.  Other sites should contact
SPAN management.

Note:  The LLNL/Obermann/NETW_BLOCK "Anti-worm" program it is *not* completely
effective in stopping the worm.  I recommend you run the the "Anti-worm"
contained at the bottom of this file.

5) If you have symptoms of infection, do the following:

  5a) NASA/GSFC sites should contact the ADFTO at (301) 286-2045/9514.
      All sites should contact SPAN Management at (301) 286-7251.

  5b) Start documenting what you do to "fix" the system, this information
      may be required later.

  5c) Back up ALL your disks.  The files (in their current state) may be needed
      as evidence later.  The worm is smart enough to find disks other than
      the system disk.
   
  5d) Check your system login procedure for tampering by issuing the following
      commands:

      SEARCH SYS$SYSROOT:[SYSMGR]SYLOGIN.COM.* "OOPS!!!"
      SEARCH SYS$COMMON:[SYSMGR]SYLOGIN.COM.*  "OOPS!!!"

      If a record is found, then this file has been corrupted by the worm. 
      Restore an older version of the file from a system backup.

  5e) Run Authorize.  Check to see if the SYSTEM account has the DISMAIL flag
      set.  If so, remove it using the command:

      UAF> MOD SYSTEM /FLAGS=NODISMAIL


Recommended Actions for the Node System Manager to Take (continued):
--------------------------------------------------------------------

  5f) Issue a SHOW LOGICAL on SYS$ANNOUNCE.  If it doesn't exist, you are ok.
      If it is directed to its "normal" file, you are ok.  If it is directed
      to a data file in the wrong place, then execute the following steps:

      Write down the location where SYS$ANNOUNCE points to.  That account
      contains the worm files.

      Then $ DEASSIGN/SYSTEM SYS$ANNOUNCE

  5g) Perform searches on ALL command procedures on all of your disks.  Search
      for the string "MCR AUTHORIZE MOD FIELD".  Any procedures that have that
      string in them have been modified by the worm.  Replace them with
      backup copies.

  5h) Run Authorize.  Check to see if the FIELD account has been enabled/added.
      If so, DISUSER the account and change the password by issuing the command:

      UAF> MOD FIELD /FLAGS=DISUSER/PASS=newpassword

  5i) Check the account found in step 5f, and all other SYS$LOGIN directories
      for worm work files.  Note the location of any files found, and
      erase them.  If you find any files beginning with "C", please 
      forward them to the ADFTO and SPAN management before deleting them.

      Worm work files:  P(random-number).COM, A(random-number).DAT,
                        T(random-number).COM ,  LO(random-number).DAT,
                        OU(random-number).LIS, DIR(random-number).DAT,
                        DIR2(random-number).DAT, D(random-number).COM,
                        C(random-number).COM

  5j) Please keep your backup tapes/notes for later use.


ANTIWANK.COM Program:
---------------------

$!
$!	Antiwank.Com - This program performs two functions.  It kills any
$!	copy of the worm currently running (any process starting with NETW_
$!	in it's name) and disguises itself as a copy of the worm to help
$!	prevent new copies from being created.
$!
$!	This program should be submitted to a batch queue under the username
$!	SYSTEM.  It requires WORLD priv to check the process names on your
$!	CPU.  It runs continuously, but uses little overhead.
$!
$!	This program uses the process name "NETW_AntiWank".  It should not be
$!	confused as a copy of the worm program itself (which uses 
$!	NETW_randomnumber).
$!
$!	The system manager should add additional userids to the line
$!	beginning with SEND_MAIL_TO.  If the program detects the worm,
$!      it will send a detection message to the userids in SEND_MAIL_TO.  
$!
$!	John McMahon
$!	NASA/GSFC CODE 630.4
$!
$!	18-OCT-1989 16:11:56.21 
$!
$!	SPAN:		SDCDCL::FASTEDDY
$!	Internet:	Fasteddy@Dftnic.Gsfc.Nasa.Gov
$!	Bitnet:		Fasteddy@Dftbit
$!
$!	Phone:	301-286-2045
$!
$ Set NoON
$ AntiWank_Name = "NETW_AntiWank"
$ Process_Name_Prefix = "NETW_"
$ Send_Mail_To = "6153::FASTEDDY,SYSTEM,6283::NETMGR"
$ Set Process/Priv=(World)
$ Set Process/Name="''AntiWank_Name'"
$ Start:
$ Context = ""
$ Pid_Loop:
$ Check_Pid = F$Pid(Context)
$ If Check_Pid .Eqs. "" Then Goto End_Pid_Loop
$ Check_Prcnam = F$Edit(F$Getjpi(Check_Pid,"PRCNAM"),"TRIM")
$ Write Sys$Output "Process Name: ",Check_Prcnam
$ If Check_Prcnam .Eqs. AntiWank_Name Then Goto Pid_Loop
$ If F$Extract(0,5,Check_Prcnam) .Eqs. Process_Name_Prefix Then -
  Gosub Action_Routine
$ Goto Pid_Loop

$ End_Pid_Loop:
$ Write Sys$Output F$TIME()," ANTIWANK is still working for you"
$ Wait 00:10:00
$ Goto Start

$ Action_Routine:
$ Write Sys$Output "Action Routine"
$ Username = F$Getjpi(Check_Pid,"Username")
$ Stop/Id='Check_Pid'
$ Mail NL: 'Send_Mail_To' -
  /SUBJECT="Worm Terminated ''$Status' ''Check_Prcnam' ''Check_Pid' ''Username'"
YES
$ Return

=== END OF REPORT ===

