Malicious Worms Still Probing Microsoft Vulnerability - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
IoT
News

Malicious Worms Still Probing Microsoft Vulnerability

Three versions of the Korgo worm have appeared this week, taking advantage of a month-old vulnerability.

A trio of malicious worms is taking advantage of a month-old vulnerability in Microsoft Windows operating systems, evidence that not all systems have been patched, security firms said Thursday.

Three versions of the Korgo worm have appeared this week, all exploiting the LSASS flaw within Windows that was disclosed and patched in mid-April.

Korgo.a, Korgo.b, and Korgo.c all scan for unpatched systems--like Sasser, the first worm to use this hole in Windows, Korgo doesn't arrive via E-mail--and when one is detected, open a back door and upload their payload.

Also known as Padobot, Korgo "chooses the IP-addresses of random machines to infect and attack, similar to other worms which exploit the same LSASS vulnerability," Finnish security firm F-Secure said in an advisory.

The worms open a variety of TCP ports, including 113, 445, 2041, 3067, and 6667 as a back door, then communicate with a variety of Internet Relay Channel servers for further commands and to receive data. Once compromised, the worms may let attackers gain full control of the system.

Although the Korgo line has been dubbed a minor threat by virtually all anti-virus firms—Symantec Corp, ranked the three as a "2" in its 1-through-5 assessment scale--F-Secure noted that Korgo "seems to be stealing user information very aggressively through keylogging techniques."

F-Secure's analysis points to a Russian hacker group, dubbed the "Hangup Team," as the probable creator of Korgo.

Even though this new mini-wave of worms is not spreading particularly fast, security firms again urged users to make sure that their Windows NT, 2000, XP, and Windows Server 2003 systems are patched against the LSASS vulnerability.

The patch can be downloaded from Microsoft's Windows Update Web site, (http://v4.windowsupdate.microsoft.com/en/default.asp) or directly from here (http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx).

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
State of the Cloud
State of the Cloud
Cloud has drastically changed how IT organizations consume and deploy services in the digital age. This research report will delve into public, private and hybrid cloud adoption trends, with a special focus on infrastructure as a service and its role in the enterprise. Find out the challenges organizations are experiencing, and the technologies and strategies they are using to manage and mitigate those challenges today.
Slideshows
10 RPA Vendors to Watch
Jessica Davis, Senior Editor, Enterprise Apps,  8/20/2019
Commentary
Enterprise Guide to Digital Transformation
Cathleen Gagne, Managing Editor, InformationWeek,  8/13/2019
Slideshows
IT Careers: How to Get a Job as a Site Reliability Engineer
Cynthia Harvey, Freelance Journalist, InformationWeek,  7/31/2019
Register for InformationWeek Newsletters
Video
Current Issue
Data Science and AI in the Fast Lane
This IT Trend Report will help you gain insight into how quickly and dramatically data science is influencing how enterprises are managed and where they will derive business success. Read the report today!
White Papers
Slideshows
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Sponsored Video
Flash Poll