full-disclosure - Re: Multiple 0-days in Dark Comet RAT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <66634.1350608106@turing-police.cc.vt.edu>
Date: Thu, 18 Oct 2012 20:55:06 -0400
From: Valdis.Kletnieks@...edu
To: kaveh ghaemmaghami <kavehghaemmaghami@...glemail.com>
Cc: full-disclosure@...ts.grok.org.uk, dm@...urityfocus.com
Subject: Re: Multiple 0-days in Dark Comet RAT

On Fri, 19 Oct 2012 03:22:04 +0330, kaveh ghaemmaghami said:
> I appreciate  his analyze coz if somebody gets pwn in my network i
> don't have to spend time for reversing and analyzing this malware .

No, if you find one of these in your network, it means you have *bigger*
problems that you *do* need to spend time on.  The exploit is against the
C&C (Command and Control) server, *not* the bot end.

In other words - if you find this one on your net, it means somebody has
been *controlling* a botnet from a host on your net.  Just a tad more serious
than just finding a botted host.

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/