From owner-freebsd-security Fri Jun 28 13:10:48 2002 Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3E29D37B401 for ; Fri, 28 Jun 2002 13:10:37 -0700 (PDT) Received: from neptun.twoj.pl (neptun.goo.pl [80.48.39.2]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1064543E0A for ; Fri, 28 Jun 2002 13:10:36 -0700 (PDT) (envelope-from bugtraq-return-5401-cinek=goo.pl@securityfocus.com) Received: by neptun.twoj.pl (Postfix, from userid 107) id 43E773AC03; Fri, 28 Jun 2002 22:10:29 +0200 (CEST) Received: from sauron.mediasystems.pl (sauron.mediasystems.pl [80.48.39.11]) by neptun.twoj.pl (Postfix) with ESMTP id F2C8F3ABAD for ; Fri, 28 Jun 2002 22:10:28 +0200 (CEST) Received: from outgoing.securityfocus.com (outgoing2.securityfocus.com [66.38.151.26]) by sauron.mediasystems.pl (Postfix) with ESMTP id 2EC082729B for ; Fri, 28 Jun 2002 22:10:41 +0200 (CEST) Received: from lists.securityfocus.com (lists.securityfocus.com [66.38.151.19]) by outgoing.securityfocus.com (Postfix) with QMQP id 9F5708F290; Fri, 28 Jun 2002 13:16:10 -0600 (MDT) Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm List-Id: List-Post: List-Help: List-Unsubscribe: List-Subscribe: Delivered-To: mailing list bugtraq@securityfocus.com Delivered-To: moderator for bugtraq@securityfocus.com Received: (qmail 14163 invoked from network); 28 Jun 2002 19:46:23 -0000 Message-ID: <32946.80.97.81.54.1025293566.squirrel@mihai.tfm.ro> Date: Fri, 28 Jun 2002 22:46:06 +0300 (EEST) Subject: Re: Apache worm in the wild From: "Mihai (Cop) Moldovanu" To: In-Reply-To: <20020628125817.O68824-100000@axis.tdd.lt> References: <20020628125817.O68824-100000@axis.tdd.lt> X-Priority: 3 Importance: Normal X-MSMail-Priority: Normal Cc: , , Reply-To: mihaim@tfm.ro X-Mailer: SquirrelMail (version 1.2.6) MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Domas Mituzas said: > Hi, > > our honeypot systems trapped new apache worm(+trojan) in the wild. It > traverses through the net, and installs itself on all vulnerable > apaches it finds. No source code available yet, but I put the binaries > into public place, and more investigation is to be done. > > http://dammit.lt/apache-worm/ > > Regards, > Domas Mituzas > > Central systems @ MicroLink Data I dissasembled it. Was a good thing that executable was not stripped. Result is here : http://projects.tfm.ro/security/apache_worm/ I will look deeper into it tonight. Best Regards , -- TFM Group . Linux Division . Mihai Moldovanu http://www.tfm.ro/ http://portal.tfm.ro/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message