Internet death worm found

Powered by SC Magazine
 

Not your typical tech support.

A worm has been found attempting to hijack computers via the Remote Desktop Protocol (RDP) used commonly for tech support.

The SANs Institute Internet Storm Centre reported traffic over RDP had increased ten-fold which was a “key indicator that there is an increase of infected hosts that are looking to exploit open RDP services".

The worm, dubbed Morto or death, compromises Windows servers and workstations by scanning subnets for remote desktop connection and guessing administrator passwords such as ‘12345’, ‘server’ and ‘password’.

Credit: SANs.

F-Secure technology chief Mikko Hypponen said that Amazon Web Services would likely be the most vulnerable target.

“Let's hope it won't be hit,” he said.

The worm could be used to launch denial of service attacks against targets nominated by command servers, Microsoft said in an advisory.

It attempted to terminate popular anti-virus programs including Sophos, McAfee, Symantec and Clam AV.

Users on a Microsoft security forum who noticed reams of outgoing 3389/TCP traffic reported that many anti-virus programs did not detect the worm. They said fully-patched systems were infected.

Once a connection had been made, Morto copied dll files to a temporary drive labeled A.

It contained an installer and a payload clb.dll file which executes in the Windows directory preferentially to the legitmate dll by the same name.

Microsoft recommended users use strong passwords, enable firewalls and update software and anti-virus.

Copyright © SC Magazine, Australia


Internet death worm found
 
 
 
Top Stories
Matching databases to Linux distros
Reviewed: OS-repository DBMSs, MariaDB vs MySQL.
 
Coalition's NBN cost-benefit study finds in favour of MTM
FTTP costs too much, would take too long.
 
Who'd have picked a BlackBerry for the Internet of Things?
[Blog] BlackBerry has a more secure future in the physical world.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Looking for storage? Seagate has five new small business NAS devices
Aug 22, 2014
Seagate has announced a new portfolio of Networked Attached Storage (NAS) solutions specifically ...
Run a small business in western Sydney?
Aug 15, 2014
This event might be of interest if you're looking to meet other people with a similar interest ...
Buying a tablet? Microsoft's Surface Pro 3 goes on sale this month
Aug 8, 2014
Microsoft has announced its Surface Pro 3 will go on sale in Australia on 28 August from ...
Apple's top MacBook Pro with Retina is now cheaper
Aug 1, 2014
Apple has updated its MacBook Pro range with faster processors and new pricing, including ...
Pass on carbon tax savings, warns ACCC
Jul 24, 2014
The ACCC is warning businesses that supply "regulated goods" to pass on any cost savings ...
Latest Comments
Polls
Which is the most prevalent cyber attack method your organisation faces?




   |   View results
Phishing and social engineering
  70%
 
Advanced persistent threats
  3%
 
Unpatched or unsupported software vulnerabilities
  12%
 
Denial of service attacks
  6%
 
Insider threats
  10%
TOTAL VOTES: 713

Vote