full-disclosure - KIBUV.B or variant?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed May 25 04:42:37 2005
From: ngiles at hushmail.com (mike king)
Subject: KIBUV.B or variant?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

the src code to these bots are traded around a great deal. most
likley either the irc owner changed the port /banner in which the
bot is to listen or they have coded it with a different port and
banner. this is not at all uncommon. so chances are its the same
program just tweaked.

On Tue, 24 May 2005 14:19:09 -0700 Michel Arboi
<michel.arboi@...il.com> wrote:
>I found a FTP server on port 42260 with this banner: 220 fuckFtpd
>0wns j0
>It looks slightly different from KIBUV.B (it says "StnyFtpd 0wns
>j0"
>and is not on the right port)
>http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WOR

>M%5FKIBUV%2EB&VSect=T
>
>Is the description incomplete or this is a new malware?
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>Hosted and sponsored by Secunia - http://secunia.com/
-----BEGIN PGP SIGNATURE-----
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 2.4

wkYEARECAAYFAkKT9BoACgkQUjm7xSZSd8FfJACgoEmpWRJFkWUqLHVuNzyGPBP0WjQA
oL/FHBIXfAr/zW8xhDyFIabLyepf
=KYJI
-----END PGP SIGNATURE-----