Technology news and Jobs arrow Information Technology News arrow Attacker mocks victims, says Symantec
Attacker mocks victims, says Symantec E-mail
by Stephen Withers   
Monday, 26 February 2007
An attacker posing as a representative of a hosting or collocation company is trying to fool people into installing a remote administration tool on their servers, according to Symantec's Security Response Weblog.

Presented as "a security guard script" provided as part of the maintenance package, it is an encoded version of the NSTView admin program.

The script also sends a notification email to the attacker containing the IP address of the system (in encoded form) it is running on. Adding insult to injury, the script identifies the sender as "L4M3r" ("lamer").

Presumably as a precaution against the destination email address being shut down, the script also opens an HTML page which contains a hidden reference to a certain server. By checking the logs of that system, the attacker can identify sites that have requested pages from that server and that must therefore be running the script.

In other news, Symantec has identified a Trojan dubbed Pirlames masquerading as a Japanese screensaver and spreading via the Winny filesharing network. It overwrites files that have .TXT, .JPG, .ZIP extensions or no extension at all with manga-style images.

According to Symantec, this Trojan was created with the P2P-Destroyer Pro tool.{moscomment}

Please enable JavaScript in your browser to post your comment!


Get stories like this delivered daily - FREE - subscribe now
 
< Next story in category   Previous story in the category >
iTWire user statistics Visitors last 30 days
Suscribers
904,266
13,751
#1 independent technology news advertise here
  •   *  
  • Search
  • AdvSeach
  • Login
  • Events
  • FreeStuff
Subscribe to our free e-newsletter