Internet death worm found

Powered by SC Magazine
 

Not your typical tech support.

A worm has been found attempting to hijack computers via the Remote Desktop Protocol (RDP) used commonly for tech support.

The SANs Institute Internet Storm Centre reported traffic over RDP had increased ten-fold which was a “key indicator that there is an increase of infected hosts that are looking to exploit open RDP services".

The worm, dubbed Morto or death, compromises Windows servers and workstations by scanning subnets for remote desktop connection and guessing administrator passwords such as ‘12345’, ‘server’ and ‘password’.

Credit: SANs.

F-Secure technology chief Mikko Hypponen said that Amazon Web Services would likely be the most vulnerable target.

“Let's hope it won't be hit,” he said.

The worm could be used to launch denial of service attacks against targets nominated by command servers, Microsoft said in an advisory.

It attempted to terminate popular anti-virus programs including Sophos, McAfee, Symantec and Clam AV.

Users on a Microsoft security forum who noticed reams of outgoing 3389/TCP traffic reported that many anti-virus programs did not detect the worm. They said fully-patched systems were infected.

Once a connection had been made, Morto copied dll files to a temporary drive labeled A.

It contained an installer and a payload clb.dll file which executes in the Windows directory preferentially to the legitmate dll by the same name.

Microsoft recommended users use strong passwords, enable firewalls and update software and anti-virus.

Copyright © SC Magazine, Australia


Internet death worm found
 
 
 
Top Stories
IBM denies plans to cut 112k jobs
But admits to further restructuring.
 
ATO investigates 25 tech giants in tax hunt
Prepared to take tax evaders to court.
 
Immigration, Customs restructure IT leadership
Customs CIO promoted into transformation role.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Franchisees, here's something you should know about
Jan 23, 2015
You need to know the Code if you are a franchisee or franchisor as the penalties are significant.
Xero users rejoice! Quoting has finally arrived
Jan 23, 2015
It has taken years, but Xero has at last added integrated quoting to its online accounting software.
You can now get a no-contract wi-fi tablet from Telstra
Jan 17, 2015
Telstra has began selling wi-fi tablets out of contract without paying extra for cellular ...
Get your business ready for 2015: mobile payments
Jan 2, 2015
These handy apps from MYOB, Xero and others can reduce your administrative load and improve ...
Xero prepares for key feature coming in 2015
Dec 19, 2014
Xero users will be able to track how their business is comparing to other Xero users.
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  36%
 
Your insurance company
  5%
 
A technology company (Google, Facebook et al)
  9%
 
Your telco, ISP or utility
  8%
 
A retailer (Coles, Woolworths et al)
  4%
 
A Federal Government agency (ATO, Centrelink etc)
  18%
 
An Australian law enforcement agency (AFP, ASIO et al)
  14%
 
A State Government agency (Health dept, etc)
  7%
TOTAL VOTES: 3002

Vote
Do you support the abolition of the Office of the Information Commissioner?

   |   View results
I support shutting down the OAIC.
  27%
 
I DON'T support shutting the OAIC.
  73%
TOTAL VOTES: 954

Vote