full-disclosure - Possible First Crypto Virus Definitely Disc overed!

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <28A2E0D6A920954ABBF13AF712CEBDB601BB882F@exchange05.bnl.gov>
From: cmeeusen at bnl.gov (Meeusen, Charles D)
Subject: Possible First Crypto Virus Definitely Disc
	overed!

"Men like me, we need a room full of clues"

--Doug.

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com]On Behalf Of Harlan
Carvey
Sent: Tuesday, June 08, 2004 12:40 PM
To: full-disclosure@...ts.netsys.com
Cc: Billy B. Bilano
Subject: Re: [Full-Disclosure] Possible First Crypto Virus Definitely
Discovered!

Bill,

>From your post, you don't seem to have a great deal of
detailed information to share about this issue...

> The virus works on port 443. 

Wouldn't it then be, by definition, a worm?

> It seems to accept inbound connections on that
> port as well and, presumably, awaits for commands
> from some series of
> servers elsewhere. Perhaps taking orders? 

What information do you have to support this
assumption?

> I also captured some of the
> traffic and attempted to analyze it up but it looks
> like -- you heard it
> here first, folks -- the payload is encrypted!

If this worm runs over SSL, as you say, then wouldn't
you expect it to be encrypted?  

> Is this the first of a coming
> storm of crypto viruses we've all been eagerly
> fearing? 

Is it?
http://www.us-cert.gov/current/current_activity.html#pct

http://www.cert.org/advisories/CA-2002-27.html

To be totally honest, Bill, I don't see a great deal
of information in your post that supports any of your
assertions/assumptions.  If this thing is spreading
the way you say it is, then it's a worm.  

Regardless, there isn't any information in your post
that clearly shows that this worm infects both Windows
and Unix hosts.  In fact, one thing that does seem
clear in your post is that you haven't collected any
information from the "infected" hosts, but rather all
you've got so far is network traffic via
Ethereal...and to be honest, any worm running over SSL
is going to be encrypted...

> At any rate, this is your heads up, folks! You heard
> it here first! Be on
> the lookout for this first, very nasty CRYPTO VIRUS!

Thanks.  Noted.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html