Internet death worm found

Powered by SC Magazine
 

Not your typical tech support.

A worm has been found attempting to hijack computers via the Remote Desktop Protocol (RDP) used commonly for tech support.

The SANs Institute Internet Storm Centre reported traffic over RDP had increased ten-fold which was a “key indicator that there is an increase of infected hosts that are looking to exploit open RDP services".

The worm, dubbed Morto or death, compromises Windows servers and workstations by scanning subnets for remote desktop connection and guessing administrator passwords such as ‘12345’, ‘server’ and ‘password’.

Credit: SANs.

F-Secure technology chief Mikko Hypponen said that Amazon Web Services would likely be the most vulnerable target.

“Let's hope it won't be hit,” he said.

The worm could be used to launch denial of service attacks against targets nominated by command servers, Microsoft said in an advisory.

It attempted to terminate popular anti-virus programs including Sophos, McAfee, Symantec and Clam AV.

Users on a Microsoft security forum who noticed reams of outgoing 3389/TCP traffic reported that many anti-virus programs did not detect the worm. They said fully-patched systems were infected.

Once a connection had been made, Morto copied dll files to a temporary drive labeled A.

It contained an installer and a payload clb.dll file which executes in the Windows directory preferentially to the legitmate dll by the same name.

Microsoft recommended users use strong passwords, enable firewalls and update software and anti-virus.

Copyright © SC Magazine, Australia


Internet death worm found
 
 
 
Top Stories
Windows 10 lands in Australia
Campaign to get business to upgrade kicks off.
 
NSW to build its own myGov
Service NSW digital profiles available by September.
 
Android bug leaves a billion phones open to attack
Hackers only need phone number to target devices.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Windows 10 is here! (For some)
Jul 29, 2015
Delivery of the free upgrade versions of Windows 10 began today - have you got yours yet?
Microsoft reveals Microsoft Send, a new enterprise chat app to rival Slack
Jul 27, 2015
Microsoft Send is MSN Messenger for grownups, and you could be using it at work very soon
Developers offered $500,000 grants to find HoloLens uses
Jul 8, 2015
Can augmented-reality end up in business?
Microsoft Tossup: The planning app for unorganised groups of friends
Jul 8, 2015
App allows friends to research venues, vote on plans and chat. And depending on how you run your ...
Windows 10 drops 29 July... but only for some
Jul 6, 2015
If you've reserved your copy of Windows 10 and are keenly awaiting its 29 July release, don't ...
Latest Comments
Polls
Should law enforcement be able to buy and use exploits?



   |   View results
Yes
  14%
 
No
  50%
 
Only in special circumstances
  17%
 
Yes, but with more transparency
  19%
TOTAL VOTES: 732

Vote