IRC bot latches onto Plug-and-Play vuln
PrintSecond route to 'root'
Posted in Anti-Virus, 16th August 2005 10:59 GMT
Free whitepaper – Avoiding 7 common mistakes of IT security compliance
The Microsoft Plug-and-Play vulnerability exploited by the ZoTob worm has been harnessed to create an IRC bot. IRCBot-ES uses the vulnerability to spread instead of more common vectors such as Windows RPC security vulns.
The attack provides evidence that virus writers are swarming around the vulnerability - which was only disclosed last week - thinking up new ways to attack vulnerable systems. Early indications are that IRCBot-ES may be more potent that ZoTob because it's easily capable of spreading around internal networks once an infected machine is plugged into a Lan. Anti-virus firm F-secure reports that one organisation has suffered widespread infection from IRCBot-ES via this mechanism. Meanwhile a further variant of ZoTob has been discovered.
The clear interest from malware authors in the vulnerability underlines the need for Windows users to get patched up sooner rather than later. ®
Free whitepaper – Vulnerability management buyer's checklist
Enabling the Agile Data Center
Analyst Keynote: The Register Agile Data Center Summit
Managing desktop software for fun and profit
Breaching Fort Apache.org - What went wrong?
Snow Leopard security - The good, the bad and the missing
US Dems fill inboxes with 419 scams
BlockMaster SafeStick hardware-encrypted USB drive