sorry to be the semantic freak (I am surely not the spelling or grammar guy). But in order to call this a 'worm', it needs to self replicate. What you may have on your hand at this point is most likely a tool to collect bots for some kind of irc bot network (just guessing here) based on the small number of sources at work here. On the other hand, I am seeing some advances in this type of exploits around. It maybe that the kids finally learned to build better 'offset libraries' to make this exploit more efficient. > A) the host inserted in the string is the IP address, and not the > hostname (any reference to your web site would have been via name) > > B) this worm has attacked 6 different networks so far, in one case hitting > 740 ip address on one network and 504 ip addresses on another network. > > C) worm has attempted to contact hosts that are not running a web server > (scanning) > > D) Once worm finds a web server, it only sends the search string to MS > servers. > > For more information on worm, see: > see MS announcement of vulnerability March 17th: > http://www.microsoft.com/technet/security/bulletin/ms03-007.asp > > For lists of the source ip addresses and networks attacked, see: > > http://www.hackertrap.net/IP.pl?IP=216.5.78.37 > and > http://www.hackertrap.net/IP.pl?IP=12.210.139.232 > > -- > Michael Scheidell > SECNAP Network Security, LLC > (561) 368-9561 scheidellat_private > http://www.secnap.net -- -------------------------------------------------------------- SANS Internet Storm Center http://isc.sans.org _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
This archive was generated by hypermail 2b30 : Wed May 07 2003 - 05:54:25 PDT