Random Entry: Telkom, JM Attorneys, Meiring & Company Inc.
< Microsoft Patches a month late | Targeted Penetration >
< Microsoft Patches a month late | Targeted Penetration >
A worm exploiting the MS05-051 Windows Distributed Transaction Coordinator vulnerability has been released. The first variant was crippled, but it appears a fixed one has been released. F-Secure has done the footwork on this with the help of malware samples from the ISC. Both worms are using the exploit code released by Swan on Dec 1st. They are calling it Dasher. The ISC thinks this is what has been responsible for the spike in port 1025 activity.
The now-typical rapid variation of malware is occuring. Dasher.C is out with an anti-anti-malware payload, probally more to come.
Patch, firewall port 1025, update anti-virus, monitor (snort sigs).
update: added link to snort rules
update: added link to dasher.c
Trackbacks
Trackback specific URI for this entry
No Trackbacks