[iwar] [fc:Alpha.Force.on.Voyage.to.Hack.Web.Servers]

From: Fred Cohen (fc@all.net)
Date: 2001-11-26 23:45:34

Next message: Fred Cohen: "[iwar] [fc:Road.Warriors.of.the.Hindu.Kush:.The.Battle.for.the.Lines.of.Communication.in.the.Soviet-Afghan.War]"
Previous message: Fred Cohen: "[iwar] [fc:Steve.Gibson.accidentally.creates.DoS.tool]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Message-Id: <200111270745.fAR7jZD08426@red.all.net>
To: iwar@onelist.com (Information Warfare Mailing List)
Organization: I'm not allowed to say
From: Fred Cohen <fc@all.net>
Mailing-List: list iwar@yahoogroups.com; contact iwar-owner@yahoogroups.com
Precedence: bulk
Date: Mon, 26 Nov 2001 23:45:34 -0800 (PST)
Reply-To: iwar@yahoogroups.com
Subject: [iwar] [fc:Alpha.Force.on.Voyage.to.Hack.Web.Servers]
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

Alpha Force on Voyage to Hack Web Servers

By Robyn Weisman, www.NewsFactor.com, 11/26/2001
<a href="http://dailynews.yahoo.com/h/nf/20011126/tc/14957_1.html">http://dailynews.yahoo.com/h/nf/20011126/tc/14957_1.html>

Internet security firm SecurityFocus.com has discovered new hacker
"malware" that unites the ability to launch distributed denial of
service (DDoS) attacks with the replicating technologies that, until
now, were automated only in computer viruses and worms.

According to SecurityFocus.com, the new malware, known as Voyager Alpha
Force, "is human-controlled through Internet Relay Chat (IRC)
communications by connecting to an IRC server and joining a
password-protected channel."

Voyager subsequently enables hackers to control a large number of "bots"
on infected Microsoft SQL server hosts. Hackers can then manipulate
these controlled agents, either to start a DDoS attack or to continue
reproducing on other incorrectly configured SQL hosts.

How It Works

"The code contains a few different DoS functions, which the person
controlling the agents can choose from," Ryan Russell, an incident
analyst for SecurityFocus.com, told NewsFactor Network. "All they have
to do is issue a single command for the type of DoS they want, and the
victim's address. However, many victims that are online at the moment
will carry out the command."

Russell explained that if a system administrator (SA) does not have a
password on his or her MS SQL Server SA account, any attacker could
execute whatever command they want on that particular server.

"Voyager checks to see if it can issue a 'ver' command, and if that
succeeds, it builds a script for the victim's FTP client program that
will cause the victim to download a copy of the code," Russell said.

"It has been reported elsewhere that the FTP server was shut down, so
this thing can't spread any longer, [but] that's not correct [because]
there are commands to change the FTP server, which makes it easy for the
person controlling the attacks to simply move his files elsewhere,"
Russell said.

"We know for a fact that there were still new infections taking place
after the first FTP server was shut down."

P2P: Latest in Hacker Tools

Matthew Kovar, Internet security analyst for the Yankee Group, told
NewsFactor that peer-to-peer (P2P) services such as instant messaging
will be the dominant exploit target for hackers as these services are
rolled out to corporate customers.

Said Kovar: "Information security officers should take appropriate steps
to create policies and procedures that limit and control the utilization
of these services, even going so far as to disallow them altogether."

Perfect Wedding Trousseau?

Bill Malik, vice-president and research area director of Gartner Inc.'s
Internet security group, told NewsFactor that while he had not yet heard
of Voyager, it certainly seems plausible.

"The advice that users configure their systems to replace default
passwords is about forty years old -- and still true," said Malik. "We
can't move forward and start exploring the consequences of new mistakes
unless we collectively stop making the same old mistakes."

Malik found it interesting that the malware exploits something old --
improperly installed SQL Server -- and something new -- a messaging
service.

Quipped Malik: "If they were to additionally exploit something borrowed
(shareware) and something blue (an online porn site), they would have a
perfect wedding trousseau."

------------------
http://all.net/ 

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/

Next message: Fred Cohen: "[iwar] [fc:Road.Warriors.of.the.Hindu.Kush:.The.Battle.for.the.Lines.of.Communication.in.the.Soviet-Afghan.War]"
Previous message: Fred Cohen: "[iwar] [fc:Steve.Gibson.accidentally.creates.DoS.tool]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

This archive was generated by hypermail 2.1.2 : 2001-12-31 20:59:59 PST