Printable View
And they're off! Wonder if we'll see another "faceoff" between the malware writers.
Esbot
http://securityresponse.symantec.com...2.esbot.a.html
I'd be cool to see them fighting each other with their bots.
Easy enough to win... shutdown the IRC servers they're being controlled from.
So exciting... I'll get the pop corn.
Quote:
from here: http://www.theregister.com/2005/08/16/irc_bot/ Microsoft Plug-and-Play vulnerability exploited by the ZoTob worm has been harnessed to create an IRC bot. IRCBot-ES uses the vulnerability to spread instead of more common vectors such as Windows RPC security vulns.
I've already seen this, in fact, one of the C&C servers was located in Paris, France. Needless to say that it's been "erased". ;)
One of the hosts we were infected wi......errr.....I mean we grabbed a sample from was attempting mad IRC connections to the C&C. :)
Why do you suppose there is so much exploit code out for ms05_039 that is ready to compile? Usually with exploits like this, the POC code is altered just enough to keep skiddies from reaking havoc with it. I found a bunch of sites that are hosting versions of the code without errors in it. Pretty dangerous....even Metasploit had a module for this the day after the code hit the wild. Anyone have any ideas as to why this sploit has been published so much more carelessly than previous ones?
It's sort of funny. The home users, the ones least likely to have a patch installed, are the ones who have to wait for the AV vendors the longest.
Not that I'm worried, I have all patches installed on the whole one box with a Windows installation which is my laptop dual booting SUSE and XP. So for this box which is Slackware and my server with SUSE and my other box with Free BSD 5.4.... Not worried.
General frustration with MS has escalated greatly with all the rounds of issues found in the last few months. Attitudes are changing and there is more of a, "you get what you deserve" approach to code release now.Quote:
Anyone have any ideas as to why this sploit has been published so much more carelessly than previous ones?
If you want to experience this first hand, go ahead and report a vulnerability to [email protected] and see what happens. I have had numerous issues in the past when simply attempting to alert them to a problem. The red tape is tremendous and certainly not worth it.
On the other hand, watch how quickly they (Microsoft) respond when they find exploit code in the wild.
Quote:
Originally posted here by thehorse13
On the other hand, watch how quickly they (Microsoft) respond when they find exploit code in the wild.
Good point...I guess that means the future of these types of exploits ought to be pretty interesting. Not a bad time to be employed in the field of network security. ;)
I don't get why they made an worm that distributes itself via IRC. In my opnion that is not a smart way. What kind of a worm is it. I mean is it a .exe or is it programmed in visual basic so you can get infected by it using WORD? (i didn't make a mistake did i about vb and word?)
But with 2 diffrent kinds there is no real competition, At least not in my opinion.
Why do you say that? It's actually very smart. This is how they can quickly spread it world-wide with little to no interference from ISPs who filter protocols on their network.Quote:
I don't get why they made an worm that distributes itself via IRC. In my opnion that is not a smart way.
1) You have a C&C that can pass commands down to all zombies you control.
2) You can setup C&Cs without a problem and provide false info to a shady ISP.
3) You can trade/sell botnets and their data to other criminals.
4) Many people are unware of IRC and what it can do (old skool).
5) You can drop just about any kind of code to your victim machine and change it on the fly.
6) You can use your botnet to DoS/extort money from online businesses which if taken down even for a day may face bankruptcy.
7) ISPs are not going to filter IRC traffic and its very tough to keep up with the actual servers that are using the protocol in a nasty way
8) ISPs will more than likely filter CIFS and NetBIOS traffic, the preferred method of worm writers to propigate.
The list goes on...
It exploits the PnP service. Read this and you'll understand exactly what it does.Quote:
I mean is it a .exe or is it programmed in visual basic so you can get infected by it using WORD?
http://www.microsoft.com/technet/sec.../MS05-039.mspx
Did I call it or did I call it?
http://www.f-secure.com/weblog/#00000631Quote:
This is not a viruswar, this is a botwar!
Is it wrong to be excited about something like this?
I'd love to be in symantecs "war rooms" right now watching this unfold on the "big screens".
I'll bring the keg and pop corn!