| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <029601c3672e$90b08570$227ae792@ict.ru.ac.za> From: bvi at lair.moria.org (Barry Irwin) Subject: W32/Welchia, W32/Nachi backdoor? >From the AUSCERT announcement >It usually arrives as DLLHOST.EXE (~10,240 bytes) and opens port 707, for its malicious routines. >Similar to the earlier MSBLAST worm variants, this malware also exploits the RPC DCOM Buffer >Overflow,and instructs target systems to download its copy from the affected system using the TFTP >program [1] >creates a backdoor listening on TCP/707 or some other randomly chosen port between TCP/666 and >TCP/765 [2] Telnetting to this port seems to disconnected after 1-5 characters have been entered? This doesn't look like TFTP (port 65/tcp&UDP), and the windows tftp client doesn't seem to offer any means of specifying a port to connect to? Is this some kind of password protected backdoor ? Barry [1]http://www.auscert.org.au/render.html?it=3359&cid=1 [2]http://securecomputing.stanford.edu/win-rpc.html -- Barry Irwin bvi@...ia.org http://lair.moria.org
Powered by blists - more mailing lists