TROJANS & BACKDOORS — THE HEADLINES
2002/1/15
VBS/RTF-Senecs + Troj/Sub7-21-I
2002/1/10
AIM Filter contains spyware and backdoors
2002/1/04
Troj/Download-A
2001/11/27
W32/Badtrans-B & Troj/PWS-AV
2001/11/26
Hybrid DDoS worm strikes Microsoft SQL Server
TROJANS & BACKDOORS — THE LINKS
There are 3 links to external Web sites for this category.
The file was last modified on: Tuesday; 2001/11/27, 13.13 MET
Submit a link:
TROJANS & BACKDOORS — THE NEWS
2002/1/15
21:52 +0100
[Trojans & Backdoors] VBS/RTF-Senecs and Troj/Sub7-21-I Aliases: Troj/Senecs, W32/Lastscene@mm, TROJ_SCENES are a Visual Basic script worm and Trojan Horse that arrive in an email message with the subject: "Scene from last weekend," message body: "Please do not forward," attachment filename: scenes.zip.
The attached ZIP file contains an RTF document scenes.wri. If the document is opened, two icons are displayed for two embedded objects. Both icons appear to be icons of an image file but the actual embedded object is an executable.
If the embedded executable is launched, it drops and runs a VBS file which attempts to send scenes.zip to all contacts in the Microsoft Outlook address book. Troj/Senecs also drops two additional Trojans.
Troj/Optix-03-C is a backdoor Trojan horse that will run in the background as a server process, allowing a remote user (using a client program) to gain access and control over the machine. When first run, it creates the subdirectory \OleFiles\, moves itself there and creates a Registry entry to ensure that the server process is run automatically each time the machine is restarted.
Troj/WebDL-E attempts to download and run a program from a website hosted at tripod.com. The downloaded program is the Troj/Sub7-21-I Backdoor Trojan horse. Troj/WebDL-E will also attempt to send a notification message of its success to an ICQ account. After running, the Trojan horse removes itself from the system.
Troj/Sub7-21-I is a backdoor Trojan horse. When the server program is installed, the computer is exposed to security attacks from remote locations. Once the connection is established, the attacker can acquire sensitive information such as passwords and take control over the infected computer. // c.f. Sophos
::
[dre].
Comments (3)
2002/1/10
11:44 +0100
[Trojans & Backdoors] The w00w00 group has announced that AIM Filter, a solution to the AIM buffer overflow vulnerability, actually contains backdoors and spyware. This became obvious when the source was released on January 5th, 2002.
At the time, Robbie Saunders' AIM Filter seemed like a nice temporary solution. Unfortunately, it instead produces cash-paid click-through over time intervals and contains backdoor code combined with basic obfuscation to divulge system information and launch several web browsers to porn sites. The w00w00 group only took the time to verify that it blocked the attack, since an analysis of AIM filter was not their priority.
In the meantime, w00w00 has cleaned up the AIM Filter code and produced a modified version available on their website, and they have removed all the backdoors and spyware. For those of you who are still interested in using the software, we strongly recommend you use this modified version instead. You will find it as: w00w00.org/files/w00aimfilter.zip // c.f. SecuriTeam
::
[dre].
Comments (1)
2002/1/04
10:27 +0100
[Trojans & Backdoors] Troj/Download-A alias Trojan.Win32.Dlder, W32.DlDer.Trojan, Dlder, TROJ_DLDER.A, Trojan/W32.Dlder is composed of two files dlder.exe and explorer.exe.
dlder.exe creates a hidden sub-directory called EXPLORER within the Windows directory. It then downloads a file from the internet and saves it as EXPLORER.EXE within the newly created sub-directory. It adds a key to the registry to run the downloaded file on system restart.
EXPLORER.EXE creates a security hole in the user's system. It sends confidential information such as host IP address, browser name, and URLs visited to an external URL. It copies DLDER to the Windows directory, and adds a key to the registry to run DLDER.EXE on system restart. The Trojan is therefore able to constantly update EXPLORER.EXE from a remote location.
::
[dre].
Comments (6)
2001/11/27
11:07 +0100
[Trojans & Backdoors] A new variant of the mass-mailer Internet worm Badtrans that installs a backdoor program which can allow attackers to access recipients' computers is spreading on the Internet, according to virus alerts from a number of anti-virus companies. The worm, called I-Worm.Badtrans.B alias Win32.Badtrans-B@mm, W32/Badtrans@mm, W32/Badtrans-B, is a new variant of the half-year old Badtrans virus, InfoWorld reports.
The variant is executed when a user opens an infected e-mail and does not require a user to click on an attachment, as many mass mailer worms do, according to Activis and TruSecure virus alerts. The worm exploits a security vulnerability in Microsoft's Outlook and Outlook Express e-mail clients to automatically execute the attachment when the e-mail is opened, they said.
Badtrans is even more devious in that it arrives in the recipient's in-box with a "Re:" subject line to an e-mail actually sent by the user, according to McAfee.com and TruSecure. There is some disagreement, however, as to what happens after the worm is executed. According to TruSecure and Network Associates, the worm will send itself to all e-mail addresses listed in unread messages in the victim system's inbox. Activis, however, contends that the worm sends itself to all addresses listed in the user's address book, much like other mass mailers.
What happens next isn't in doubt, however, as all companies agree that the worm then installs a Trojan horse, or backdoor, program named Troj/PWS-AV by Sophos, that will allow an attacker to gain access to the infected computer and then attempts to sends the IP address of the infected machine to the worm's author.
After execution, Badtrans also runs a keylogger program that can record all data entered via the keyboard, including passwords, credit card numbers, and other personal information, according to Activis and McAfee.com. The data gathered by the keylogger is saved in encrypted form on the system's hard drive, they said.
The worm will appear in e-mail boxes with either no text in the body of the message or some of the original message's text, the companies said. The attachments included with the worm will appear to be .MP3, .DOC, or .ZIP files, but are actually double extension files with .SCR or .PIF extensions, the companies said. These attachments are 13,312 bytes in length, according to Network Associates.
The companies recommended that users update their anti-virus software immediately and that companies block the transfer of attached files at their e-mail gateways. Users are also urged to apply the patch to close the security hole that the worm exploits. The patch can be found at MS01-027.
::
[dre].
Comments (0)
2001/11/26
10:59 +0100
[Trojans & Backdoors] A tool that attacks an old exploit in Microsoft SQL servers and uses a combination of methods to spread is causing concern in the US, says ZDnet UK. A known vulnerability in Microsoft SQL server systems is being targeted by a hybrid worm that combines a distributed denial of service attack (DDoS) with the automated propagation techniques used by worms such as Code Red.
US-based security company SecurityFocus noticed a rapidly growing network of controlled agents known as bots on Tuesday, which reportedly increased by 600 percent in the space of six hours. The bots were being used to launch DDoS attacks on systems wrongly configured with Microsoft SQL Server software.
Mark Read, security analyst at MIS Corporate Defence Solutions, told ZDnet, "When you install SQL, at no point does it ask you for an administrator username and password—this is installed as standard, and once it is up and running the password still remains blank." He added, "If the SQL server is accessible from the Internet, people can log in using a blank password and have full access to the database, as well as the underlying operating system."
SecurityFocus said the hybrid tool has been named "Voyager Alpha Force", and is human controlled through Internet Relay Chat (IRC) communications. The bots are set up on a password-protected IRC channel, where they monitor any conversations taking place. A DDoS attack is launched when an attacker logs onto the channel and types in a command, which is then recognised and acted upon by the bots. Affected servers will then scan netblocks for other vulnerable SQL servers on port 1433, and will try to log on and run the malicious code.
Voyager Alpha Force is unlikely to cause the same scale of damage as inflicted by Code Red and Nimda, because SQL Server is not as widely used as Microsoft IIS Server, which those worms used to propogate. "The issue with the IIS exploit that affected Code Red is that it was an unpatched service and went through a normal HTTP Web port, allowing normal Internet traffic through," said Read. "The SQL vulnerability is not as bad, as providing that it is correctly configured, it shouldn't allow traffic through to the server directly."
SecurityFocus is recommending that companies running SQL Server check that their account does not have a blank password, and use a firewall to block port 1433. // c.f. SecuritySpace
::
[dre].
Comments (0)
|
