AusCERT - Worms ahoy!!!

HOME

About AusCERT

Membership

PKI Services

Training

Publications

Sec. Bulletins

Conferences

News & Media

Services

Web Log

Site Map

Site Help

Member login

Worms ahoy!!!

Date: 26 March 2009

Click here for printable version

A recent appearance of the psyb0t worm has raised concerns over a potential resurgence on a larger scale. The worm first reared its ugly head in early January this year, and is reportedly active at present. Psyb0t is unusual as it targets routers and modems rather than PCs or servers. The bot targets devices that run on Linux which includes Linksys and Netgear. It can exploit its targets through brute forcing usernames and passwords, thereafter scanning further for vulnerabilities in MySQL and phpMyAdmin servers.

Another worm rapidly gaining infamy is Conficker. It has been reported that April 1st 2009 will be the day the Conficker-C variant becomes more active. Be sure to keep your operating systems patched, ensure a high quality of strong passwords and keep an eye on your DNS traffic for unexpected increased activity. For more information, please refer to the alert we pushed earlier this week.

A timely reminder regarding April Fools Day: beware the hooligan emails with catchy subject lines. Keep your wits about you on April 1st as phishing and otherwise entertaining trojan attachments may abound - restrain spontaneous click-happy abandon!

Regards,

Patrick