From owner-freebsd-security  Fri Jun 28 12:53:47 2002
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id CD8DA37B400
	for <freebsd-security@freebsd.org>; Fri, 28 Jun 2002 12:53:41 -0700 (PDT)
Received: from devel.tfm.ro (devel.tfm.ro [193.230.227.35])
	by mx1.FreeBSD.org (Postfix) with SMTP id 892B343E0A
	for <freebsd-security@freebsd.org>; Fri, 28 Jun 2002 12:53:37 -0700 (PDT)
	(envelope-from mihaim@tfm.ro)
Received: (qmail 452 invoked by uid 518); 28 Jun 2002 19:46:06 -0000
Received: from localhost (HELO tfm.ro) (127.0.0.1)
  by localhost with SMTP; 28 Jun 2002 19:46:06 -0000
Received: from anamol.kappa.ro ([80.97.81.54])
        (SquirrelMail authenticated user mihaim@tfm.ro)
        by mihai.tfm.ro with HTTP;
        Fri, 28 Jun 2002 22:46:06 +0300 (EEST)
Message-ID: <32946.80.97.81.54.1025293566.squirrel@mihai.tfm.ro>
Date: Fri, 28 Jun 2002 22:46:06 +0300 (EEST)
Subject: Re: Apache worm in the wild
From: "Mihai (Cop) Moldovanu" <mihaim@tfm.ro>
To: <domas.mituzas@microlink.lt>
In-Reply-To: <20020628125817.O68824-100000@axis.tdd.lt>
References: <20020628125817.O68824-100000@axis.tdd.lt>
X-Priority: 3
Importance: Normal
X-MSMail-Priority: Normal
Cc: <freebsd-security@freebsd.org>, <bugtraq@securityfocus.com>,
	<os_bsd@konferencijos.lt>
Reply-To: mihaim@tfm.ro
X-Mailer: SquirrelMail (version 1.2.6)
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Domas Mituzas said:
> Hi,
>
> our honeypot systems trapped new apache worm(+trojan) in the wild. It
> traverses through the net, and installs itself on all vulnerable
> apaches it finds. No source code available yet, but I put the binaries
> into public place, and more investigation is to be done.
>
> http://dammit.lt/apache-worm/
>
> Regards,
> Domas Mituzas
>
> Central systems @ MicroLink Data

I dissasembled it. Was a good thing that executable was not stripped.
Result is here :
http://projects.tfm.ro/security/apache_worm/

I will look deeper into it tonight.


Best Regards ,
-- 
TFM Group . Linux Division .
Mihai Moldovanu
http://www.tfm.ro/
http://portal.tfm.ro/



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message