Still More Botnets:

We're receiving yet more reports of successful social engineering attacks and
GDI+ JPEG attacks that cause a UPX'ed and Morphine'd trojan horse (Gaobot, SDbot,
RxBot) to be installed, and the resultant botnet used for typical nefarious
purposes.

Most current AntiVirus packages don't properly unpack these binaries, and don't
detect them terribly well. There are also reports that some of them are
interfering with automated AV update procedures.

Patches applied to both the computer itself and the user at the console should be
sufficient. If you have the facility to capture, or block, IRC traffic to
unknown IRC servers (sometimes not on port 6667/tcp, either), you can potentially
disrupt the botnet.

EasyDynamicOwned:

We received a report of a webserver being compromised via a long-standing
problem with a PHP script package; EasyDynamicPages:
http://www.securitytracker.com/alerts/2004/Jan/1008584.html
http://www.osvdb.org/displayvuln.php?osvdb_id=3318

The following Snort rule should catch attempts:

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP EasyDynamicPages exploit"; \
classtype:web-application-activity; sid:900018; rev:1; \
reference:url,www.securitytracker.com/alerts/2004/Jan/1008584.html; reference:cve,CAN-2004-0073; \
flow:established,to_server; uricontent:"edp_relative_path=";)

Also, be aware that EDP isn't the only vector to this vulnerability. Any PHP
page that arbitrarily include()'s from a variable that can be filled in by
a remote attacker can be exploited in a similar way:
http://www.mirrorshades.org/overflow/archives/000135.shtml

Perhaps a more generic method might be to search for URL's in your URI's,
which shouldn't happen unless you're proxying or doing odd redirects,
which happens far more often than it really should. YMMV.

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg: "handlers experimental -- URL in URI proxying with arg stacking"; \
classtype:string-detect; sid:900019; rev:1; priority:4; flow:to_server,established; tag:host,90,seconds; \
pcre:"/=(http|https|ftp).\/\/.*\?/Ui";)

At any rate, if you're a PHP developer, you should probably triplecheck your code
to make sure that an attacker can't feed you a URL like this, and if you have PHP
on your server, you should probably disable allow_url_fopen if you haven't
already.
http://www.php.net/manual/en/ref.filesystem.php#ini.allow-url-fopen

.emf.