I was reading the ISC handlers diary today and saw a post entitled “Be on the Alert”
The email comes with an attachment.. either a .zip or a .html file. If this is a truly new virus, antivirus will not detect it yet. Here’s what I’ve done to protect my network.
1) Through the use of MailScanner and MimeDefang, I’ve blocked all incoming .zip files and .html files. I have had this rule in place for years as rarely does anything legitimate come through email with a .zip or .html attachment.
2) In the post, it makes mention of the IP address being used to download the exploiter. The IP address is 173.204.119.122. Adding a simple rule to your gateway will prevent the exploiter from being downloaded and infecting a machine on the network. Here’s what I did:
# iptables -t nat -A PREROUTING -d 173.204.119.122 -j DROP
Then, on one of my other boxes:
$ wget http://173.204.119.122
--18:55:45-- http://173.204.119.122/
=> `index.html'
Connecting to 173.204.119.122:80...
Just sits there and times out. To verify that my rule worked:
# iptables -L -v -n -t nat|grep 173.204.119.122
0 0 DROP all -- * * 173.204.119.122 0.0.0.0/0
26 1560 DROP all -- * * 0.0.0.0/0 173.204.119.122
Prior to just willy-nilly firewalling this IP, I checked to see if any other legitimate websites were being hosted on that server using bing-ip2hosts. Nothing was reported.
Related posts:
Matt,
Just curious if you or your associate are seeing something like this in the headers:
“United Parcel Service of America” , where user@domain.local is the actual users’s email address. I also show “tidiest7@rivertext.com” in the return path.
PS. Love your blog dude
@Kevin: Sorry it took so long to respond.. crazy, crazy busy.
# cat maillog*|grep -i “rivertext.com”
# cat maillog*|grep -i “user@domain.local”
# cat maillog*|grep -i “United Parcel”
#
Nothing coming up in the last 30 days. I do have a lot of emails covering the details of this virus. It apparently is a big HTTP botnet. The emails that I’m receiving are confidential so I can’t share them.. but anything I come across that I think should be shared to help prevent the spread I will post here.