> I believe the following link might be of interest > and provide you with > further information about this malware. Very interesting and detailed write up. One small suggestion, though, for completeness only. When dealing w/ binaries on Win32 systems, one may very often find resource information still compiled into the executable...product version information, etc. MS does this with most all of their EXE files (can't say 100% as I haven't tested them all). However, when I analyzed the russiantopz bot, this is one of the first things I did, and found that the bot was mIRC 5.82, and that the program to hide the mIRC client window from the desktop was "hidewndw.exe". From the research I did to support my findings, this seems to be a very popular combination. The bot I analyzed had been dropped on an IIS 5.0 server, and through testing, I was able to verify that the final executable (ie, the bot itself) would have only been running in the IUSR_* context...no Admin passwords were guessed. If the compressed package of files had included any of the priv escalation EXEs (the Masy worm included the DebPloit EXE in it's package), things might have been worse. I think that the linked articles/web sites have pointed out a lot of very interesting info, and filled in the gaps left by the MS "analysis". In particular, these things aren't so much insideous, as they are successful due to laziness on the part of the admins. If these bits of malware really are as rampant as the alert would have us believe, then perhaps it's not so much a lack of security in MS products as it is in the culture of the administrators. __________________________________________________ Do You Yahoo!? Yahoo! Finance - Get real-time stock quotes http://finance.yahoo.com ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Mon Sep 09 2002 - 08:32:27 PDT