Subject: NIPC Information System Advisory 00-035:
win9x version of DDOS tool.

1. The national infrastructure protection center (NIPC) recently received information indicating the potential of a win9x version of distributed Denial of Service (DDOS) tools in the wild. The tool is initially believed to be similar to the "trinoo" and "tribe flood network (tfn)" unique tools. NIPC determined that the tool was found on 16 windows 98 machines on a University Network and that the tools were initiating UDP packets. Each of the 16 systems were found to contain a copy of Back Orifice. The infected machines appear to have communicated with a controlling node using UDP packets and the 'png' and 'pong' data using the following ports: 'png' received by infected machines on destination port 34555/udp, 'pong' sent back to controlling node on destination port 35555/udp. These tools were detected by the system administrator due to a high volume of traffic.

Analysis determined that the trinoo-like agent appeared to be running as "service exe", and that it started in the run registry entry, and listened on UDP port 34555 while running. Partial output of unix string command against the service.exe binary included the following lines:

c:\1cc\trinoo\nsfork.c
lcccrto.c
,logiciels/informatique 1cc-win32 version 3.0
c:\1cc\trinoo\1cc\_.exe
software\microsoft\windows\currentversion\run
png
bbb
aaa

The line "c:\1cc\trinoo\1cc\_.exe" indicates on the infected machines the Back Orifice server file name is "_.exe".

2. DDOS binaries have been disseminated to anti-virus vendors for possible design or modification of products to defeat this DDOS tool. Binaries have also been sent to Carnegie Mellon CERT/CC. NIPC request that all computer network owners and organizations expeditiously examine their systems for evidence of this denial of service tool. Recipients are asked to report significant or suspected criminal activity to their local FBI Office, NIPC Watch/Warning unit, Computer Emergency Response Support and other Law Enforcement Agencies, as appropriate. The NIPC watch and warning unit can be reached at (202)323-3204/3205/3206, or nipc.watch@fbi.gov.