topic Re: MBLAST in Operating System - Linux

MBLAST

Leovino A. Trinidad, Jr — Tue, 26 Aug 2003 23:45:05 GMT

Hi!

Just want to know if iptables can blick the exploit being done by MBLAST and how can it be done?

Regards,

LAT

Re: MBLAST

Steven E. Protter — Wed, 27 Aug 2003 00:54:20 GMT

If you find out what port its using, you can simply shut the port explicitly in iptables.

I'm uploading a sample iptables file that has lots of good examples.

SEP

Re: MBLAST

Jerome Henry — Wed, 27 Aug 2003 05:36:32 GMT

And you know it uses ports 135, 139, 445 and 4444. Using Steven's example iptable should let you know how to block these ports.

Beware that ports 135 and 139 are also used by windows. Be careful on blocking if you use RRAS behind your firewall (which you shouldn't...)

J

Re: MBLAST

U.SivaKumar_2 — Wed, 27 Aug 2003 06:37:30 GMT

Hi,

MSBLAST worm uses windows RPC port. viz. TCP 135.

#iptables -I INPUT -i eth+ -p tcp --dport 135 -j DROP

regards,

U.SivaKumar

Re: MBLAST

Leovino A. Trinidad, Jr — Wed, 27 Aug 2003 21:31:55 GMT

Hi!

Thank you for all your responses! It's good but will it really drop or ignore all msblast packets? I'm just making it sure it will work.

To give you the background of my problem, our system are infected by msblast (which the stations are being cured)and the virus keeps on bombarding the line going to our default route which is our Firewall/Proxy server. The problem is, it's not with the Linux machine but with the 3com 4400 switch where the fw/proxy is connected. It cannot take huge packets (produce by msblast) that causes it to hang. I already made a rule in iptable wherein it will drop port 135,139,445 request and, still no positive result. I have not yet included port 4444.

Is iptables the solution? Or will I do a work-around in our network system.

Again, thank you.

Regards,

LAT

Re: MBLAST

Jerome Henry — Thu, 28 Aug 2003 12:17:02 GMT

What the iptables rule will do is stops the corresponding packets, unabling them to enter the linux box and so to be propagated to the other NIC and subnet...
But it won't remove the virus... If you have infected systems, you should decontaminate them, then use your linux box as door keeper to the internet gate...

J