Full Disclosure mailing list archives
Re: Possible First Crypto Virus Definitely Discovered!
From: Harlan Carvey <keydet89 () yahoo com>
Date: Tue, 8 Jun 2004 09:40:22 -0700 (PDT)
Bill,
From your post, you don't seem to have a great deal of
detailed information to share about this issue...
The virus works on port 443.
Wouldn't it then be, by definition, a worm?
It seems to accept inbound connections on that port as well and, presumably, awaits for commands from some series of servers elsewhere. Perhaps taking orders?
What information do you have to support this assumption?
I also captured some of the traffic and attempted to analyze it up but it looks like -- you heard it here first, folks -- the payload is encrypted!
If this worm runs over SSL, as you say, then wouldn't you expect it to be encrypted?
Is this the first of a coming storm of crypto viruses we've all been eagerly fearing?
Is it? http://www.us-cert.gov/current/current_activity.html#pct http://www.cert.org/advisories/CA-2002-27.html To be totally honest, Bill, I don't see a great deal of information in your post that supports any of your assertions/assumptions. If this thing is spreading the way you say it is, then it's a worm. Regardless, there isn't any information in your post that clearly shows that this worm infects both Windows and Unix hosts. In fact, one thing that does seem clear in your post is that you haven't collected any information from the "infected" hosts, but rather all you've got so far is network traffic via Ethereal...and to be honest, any worm running over SSL is going to be encrypted...
At any rate, this is your heads up, folks! You heard it here first! Be on the lookout for this first, very nasty CRYPTO VIRUS!
Thanks. Noted. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Possible First Crypto Virus Definitely Discovered! Billy B. Bilano (Jun 08)
- Re: Possible First Crypto Virus Definitely Discovered! madsaxon (Jun 08)
- Re: Possible First Crypto Virus Definitely Discovered! Harlan Carvey (Jun 08)
- Re: Possible First Crypto Virus Definitely Discovered! Billy B. Bilano (Jun 08)
- Re: Possible First Crypto Virus Definitely Discovered! Oliver Welter (Jun 08)
- Re: Possible First Crypto Virus Definitely Discovered! Billy B. Bilano (Jun 08)
- Re: Possible First Crypto Virus Definitely Discovered! Jon (Jun 08)
- Re: Possible First Crypto Virus Definitely Discovered! Billy B. Bilano (Jun 08)
- Re: Possible First Crypto Virus Definitely Discovered! KF (lists) (Jun 08)
- Re: Possible First Crypto Virus Definitely Discovered! VB (Jun 08)
- Re: Possible First Crypto Virus Definitely Discovered! James Bliss (Jun 08)
- Re: Possible First Crypto Virus Definitely Discovered! Jakob Jünger (Jun 08)
- RE: Possible First Crypto Virus Definitely Discovered! Aditya, ALD [Aditya Lalit Deshmukh] (Jun 10)