Topic: Plug and Play port scan reveals new worms

[Clive]

ZDNet Australia
May 19, 2004, 11:05 BST
 
Investigations into recent increases in port 5000 scans have revealed the existence of two new worms: Bobax and Kibuv.

The W32/Bobax-A worm, which employs the same Microsoft security vulnerability as the Sasser worm to break into computers, uses port 5000 to identify Windows XP systems (the port used for "Universal Plug and Play").

According to the Sophos Web site, this new worm "is capable of turning infected computers into spam factories and launchpads for denial-of-service attacks against Web sites."

The process is explained on the LURHQ security site: "unlike proxy Trojans which require the spammer to connect and send each individual piece of mail, Bobax sends the mail using a template and a list of email addresses. This has the benefit of offloading almost all the bandwidth requirements of spamming onto the Trojaned machines, allowing the spammer to operate with minimal cost."

Kibuv.B creates an FTP server on port 7955 for which any username/password combination will work. Like other malware of this type, the FTP server sends a copy of the worm in response to any file request.

The vulnerabilities exploited by these two worms are not new -- users with the latest patches from Microsoft are protected.

 
http://tinyurl.com/27tf8

[Tony]

well as you may or may not know Clive, I was running W2K Pro up to last week. And when I ran the Shields Up security scan, it infered my System was "as tight as a ducks arse"

However when I installed XP Pro and took the same tests, it failed my system on the "Plug and Play" issue. So I downloaded the small Plug n'Pray program.

This allows you at the click of a button to enable or disable Plug and Play. Needless to say I run my system with it disabled.

Edit: Microsoft have it covered with a patch...yer right....I'll put my trust in Plug n'Pray thank you.

[Clive]

Oh yes, I use "plug and pray" too.  For those who don't know, it can be downloaded from the Shields Up website.  Just follow Tony's link.