> It appears that (one > of - there might be more) infection vectors is > brute-force attack on > administrator account, using few very simple > passwords (and few account names). My analysis of the "russiantopz" IRC bot was predicated by the primary file being dumped onto an IIS5.0 server. Seems the admins had the mistaken notions that (a) The Windows Updates included the patch for directory transversal, and (b) leaving default permissions and groups in place was just fine. __________________________________________________ Do You Yahoo!? Yahoo! Finance - Get real-time stock quotes http://finance.yahoo.com ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Mon Sep 09 2002 - 08:28:19 PDT