full-disclosure - OpenSSL Worm ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0H2E007IWPUZCT@smtp2.clear.net.nz>
From: nick at virus-l.demon.co.uk (Nick FitzGerald)
Subject: OpenSSL Worm ?

> New news.
> 
> There is a new apache worm, based on the scalper worm from June.

Yes, but posting a link to the old code without clarifying that it is 
the previous thing and the current one is possibly modelled on it, is 
misleading at best.

<<snip>>
> The worm leaves no entry in httpd.log and does not crash Apache.
> After exploiting the server, it uploads its source as /tmp/.bugtraq.c
> and compiles it as /tmp/.bugtraq

...and listens on port 2002 UDP for commands to launch various DoS 
atatcks.  It also seems to have code to cooperate with other similar 
agents in a DDoS network.

> The kiddies are surely having fun at the moment.

For sure...

Regards,

Nick FitzGerald