D&C GLug - Home Page

[ Date Index ] [ Thread Index ] [ <= Previous by date / thread ] [ Next by date / thread => ]

Re: [LUG] PHP Worm traffic?

 


On 17 Dec 2013, at 16:55, Simon Avery <digdilem@xxxxxxxxx> wrote:



I think this worm has scope to become a major issue still


What's the payload? 

Symantec reports it opens a backdoor to the system (not that a new one was needed), and the system joins in the hunts for other vulnerable systems.

I would say it appears to be fairly modest payload, but the Symantec article suggests the authors have put a lot of work in to compromise all systems vulnerable to this attack suggesting to me there is a purposes other than idle curiosity.

On the other hand it isn't aggressive, an aggressive tool of this type could have owned all vulnerable servers within minutes, which suggests it isn't say a state actor with clear intent.
-- 
The Mailing List for the Devon & Cornwall LUG
http://mailman.dclug.org.uk/listinfo/list
FAQ: http://www.dcglug.org.uk/listfaq