Experts: Blame Sobig for latest spam deluge

TalkBack 5 of 19:

Next »

« Previous

• Thread View
• Flat View

Here is the orifice:

From www.cert.org
[ http://www.cert.org/incident_notes/IN-2003-03.html ]

``The worm requires a user to execute the malicious attachment either manually or by using an email client that will open the attachment automatically.

Upon successful execution, the worm installs itself as C:\%windir%\winppr.exe and also creates the file C:\%windir%\winstt32.dat. An entry is also added to the Run registry key so that this executable will be run upon system restart. The key installed in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run is ScanX with the value "c:\winnt\winppr.exe /sinc".

The program then proceeds to scan files with certain extensions (htm, html, dbx, hlp, mht, txt, wab) on the compromised system for valid email addresses, and it uses an internal SMTP engine to email itself to those addresses.''


In Unix/Linux, the usser cannot modify system directories / files at his whim. Only the superuser or privilleged accounts may execute certain management code, let alone writing in system directories.

Plus on a PC where the 'owner' is the administrator there is NO restriction as to what can be executed and what types of network packets can be put together and sent out. That is, it makes it SO EASY to usurp a PC and then start hacking into other machines that are accessible.

Under Unix/Linux only the root user or the kernel can do this. So even if one can manage to run foreign code stealthily masquareding as a legitimate user, the desctruction is STILL limited to that user's data.

cheers -m

Posted by: michael-t   Posted on: 12/09/03 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Five Steps to Determine When to Virtualize YourServers VMware Server virtualization isn't just for big companies. Entry-level ... Download Now
• Dell Helps Medical University of South Carolina Bring the Intelligent Classroom to Life Dell Established in 1824, Medical University of South Carolina (MUSC) is one of ... Download Now
• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now