Re: IPTBLE rule for Slapper" Linux Worm

[Joel Newkirk <netfilter@newkirk.us>]

On Thursday 19 September 2002 10:56 pm, Sundaram wrote:
> What is the IP rule, I have set for following worm??
>
>
> Security Alert: Eradicating the "Slapper" Linux Worm
>
> http://www.extremetech.com/article2/0,3973,538734,00.asp

(rules example below)
Inbound 443 is the most useful of these, IF you can do it, since the others depend
on the machine already being infected, which you can easily and quickly determine
yourself just after you start blocking inbound port 443, the infection vector.
Just "ls -a /tmp" and make sure there's no ".bugtraq" or ".bugtraq.c" there.
If they are you're already infected.

ExtremeTech tells us:
   Delete the files if they are already present. Do "mkdir -m a= /tmp/.bugtraq" and 
   "mkdir -m a= /tmp/.bugtraq.c", then reboot if you were already infected.  
   The permissionless directories prevent an incoming infection from taking up residence. 

They fails to mention that three seconds with an editor will create a version that 
saves itself under different names, but still partakes of the same DDoS network.

(Symantec tells us: * Run LiveUpdate, which is the easiest way to obtain virus definitions :^)

If we want to be helpful, we can log any attempt to connect to us on UDP 2002,
meaning the source is infected and thinks we are/were, and notify those servers
that they appear to be infected.


# Block "Linux.Slapper.Worm" or "apache/mod_ssl worm"
#
# log & drop any inbound packets for UDP port 2002, 
# prevents already infected system receiving instructions.
# this should only happen if we are/were infected.
# If we're feeling charitable, let the source of any 2002
# packets know that they are probably infected as well.  :^)
/sbin/iptables -A INPUT -p UDP --dport 2002 -j LOG
/sbin/iptables -A INPUT -p UDP --dport 2002 -j DROP
#
# Block inbound port 443 (Infection point) ONLY if you don't
# need to serve HTTPS from machine.
/sbin/iptables -A INPUT -p TCP --dport 443 REJECT
#
# Block outbound port 443 ONLY if you don't need to browse 
# to HTTPS from this machine.
# This blocks an already infected system from propogating.
/sbin/iptables -A OUTPUT -p TCP --dport 443 -j REJECT
#

# j