BREAKING NEWS: Internet Storm Center Announces Troubling New Phatbot Variant
The Internet Storm Center has announced the discovery of yet another variant of the “Phatbot” family of worms. This variant appears to exploit a recent vulnerability. This would be the first worm to do so. From the diary of handler Tom Liston:
=====BEGIN QUOTE=====
PhatBot exploiting LSASS?
The ISC has come into possession of what appears to be a new version of PhatBot that contains code to exploit the LSASS (LSASS: Local Security Authority Subsystem Service) vulnerabilities patched under MS04-11. Reference these old diary entries:
http://isc.sans.org/diary.php?date=2004-04-26
http://isc.sans.org/diary.php?date=2004-04-25
We are currently focusing on some keywords found in the executable that indicate that an LSASS exploit has been added, specifically, the command string "CScannerLSASS".
We are currently investigating the code, and will update the diary as new information becomes available.
Traffic matching this bot was first observed yesterday evening (EDT) at multiple US .edu's.
The bot appears to inherit all other functions usually associated with 'phatbot'.
=====END QUOTE=====
It is unknown at this time whether the worm is spreading much, but this could become a Medium-risk event if the worm is seeded well enough.
Posted
Apr 28 2004, 07:02 AM
by
trafton