Re: [LUG] PHP Worm traffic?

[Simon Avery <digdilem@xxxxxxxxx>]

I think this worm has scope to become a major issue still

What's the payload? 

Symantec reports it opens a backdoor to the system (not that a new one was needed), and the system joins in the hunts for other vulnerable systems.

I would say it appears to be fairly modest payload, but the Symantec article suggests the authors have put a lot of work in to compromise all systems vulnerable to this attack suggesting to me there is a purposes other than idle curiosity.

On the other hand it isn't aggressive, an aggressive tool of this type could have owned all vulnerable servers within minutes, which suggests it isn't say a state actor with clear intent.

 

Thank you. Some of the most affective viruses, computer or biological, are subtle in their damage.

To some extent, the payload is secondary to the method of propogation. Even if the purpose of this worm is primarily to replicate, it will be days or even hours before someone else has another exploiting the same vectors, and perhaps with a different agenda.

You can't trust malware authors to play by the rules...

S

-- 
The Mailing List for the Devon & Cornwall LUG
http://mailman.dclug.org.uk/listinfo/list
FAQ: http://www.dcglug.org.uk/listfaq