New Breed of Trojan Raises Security Concerns (IMMINENT CYBER ATTACK)

www.eweek.com ^ | June 13, 2003 | Dennis Fisher

[Nexus]

I did not mean to replicate your post. Sorry man.

[FairOpinion]

No problem.

I a glad you started the thread, it's interesting information, and even if nothing comes of it -- hopefully --that doesn't mean that the terrorists weren't planning something, we may never know.

[adam_az]

Do you remember my posts about "copycats" working from media reports, and the effect of media echo..?

check this out...

http://www.intrusec.com/55808.html

Intrusec has completed an initial analysis of a trojan that appears to be one of several that is responsible for generating substantial scanning traffic across the Internet with a TCP window size of 55808. The trojan we have isolated appears to match many of the characteristics that others in the security community have reported for this trojan. However, we do not believe that the specific trojan we have identified is the sole source of the traffic generated, and do not know that it is a primary source.

The information we've been able to gather leads us to believe that the trojan we have captured is not the original source of the 55808 traffic that has been seen, but is rather a "copycat", created to mimic the behavior of another trojan or worm. The behavior of this copycat appears to be based on press releases, news articles, and mailing lists that described its hypothetical behavior and known output. Nonetheless, this copycat trojan appears to be actively deployed on systems across the Internet and is something security professionals should be aware of.

[Ciexyz]

btt

[swarthyguy]

Bump.