Technology news and Jobs arrow Information Technology News arrow Attacker mocks victims, says Symantec
Attacker mocks victims, says Symantec E-mail
by Stephen Withers   
Monday, 26 February 2007
An attacker posing as a representative of a hosting or collocation company is trying to fool people into installing a remote administration tool on their servers, according to Symantec's Security Response Weblog.

Presented as "a security guard script" provided as part of the maintenance package, it is an encoded version of the NSTView admin program.

The script also sends a notification email to the attacker containing the IP address of the system (in encoded form) it is running on. Adding insult to injury, the script identifies the sender as "L4M3r" ("lamer").

Presumably as a precaution against the destination email address being shut down, the script also opens an HTML page which contains a hidden reference to a certain server. By checking the logs of that system, the attacker can identify sites that have requested pages from that server and that must therefore be running the script.

In other news, Symantec has identified a Trojan dubbed Pirlames masquerading as a Japanese screensaver and spreading via the Winny filesharing network. It overwrites files that have .TXT, .JPG, .ZIP extensions or no extension at all with manga-style images.

According to Symantec, this Trojan was created with the P2P-Destroyer Pro tool.{moscomment}
Powered By Joomla Tags

Please enable JavaScript in your browser to post your comment!

 
< Next story in category   Previous story in the category >
iTWire user statistics Visitors last 30 days
694,279
Subscribers 15,210
#1 independent technology news advertise here
  •   *  
  • Search
  • AdvSeach
  • Login
  • Events
  • FreeStuff

- Advertisement -

Featured Whitepapers

Follow iTWire on Twitter

About iTWire

iTWire is all about technology news, information, jobs and community for the IT and telecommunications industry professional. Subscribe to our free ICT daily newsletter