🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: be.comp.security
Article #791

Re: [ISC diary] Russian IIS Hacks - yet another technique for spreading and installing "spamware"

#791
From: Jan Reilink
Date: Fri, 25 Jun 2004 09:25
50 lines
3010 bytes
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Filbert wrote:

| Jan Reilink wrote:
|
|>-----BEGIN PGP SIGNED MESSAGE-----
|>Hash: SHA1
|>
|>Tijd om je IIS servers (extra) in de gaten te houden:
|>
|><http://isc.incidents.org/diary.php?date=2004-06-24>
|>"Thanks to everybody who generously provided updates to us today. We still
|>do not know how the IIS servers are originally infected with the
|>JavaScript or the modification to the configuration files. Any additional
|>theories or ideas are welcome.
|>
|>The reason for the attack seems to point back to the spamming community.
|>There is quite a bit of evidence that what we are seeing is yet another
|>technique for spreading and installing "spamware" (software that assists
|>in either creating, relaying, proxying, or otherwise participating in the
|>sending of spam.) We don't see any evidence that this attack is related to
|>the construction of a DDoS network or other type of typical zombie-based
|>attack group. However, we continue to monitor and will provide updates if
|>anything further develops.
|>
|>[...]"

[...]
| Ook even hier gezet, Jan.
|

Jan Ehrhardt sprak in nl.internet.misbruik:
| Er staat ook al een (alarmerend) verhaal op WebWereld:
| http://www.webwereld.nl/nieuws/18890.phtml

- --
Met vriendelijke groet / Best regards,
Jan Reilink, VEVIDA Nederland BV

Postbus 329, 9700 AH GRONINGEN, +31(0)50 - 5492234
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Netscape - http://enigmail.mozdev.org

iD8DBQFA2+97yExGSa/qny0RAskYAJ0VI/RzKPwB61DvNZT7leGpLQIV9gCfTVh0
l3ri56QafRCutsKbRLjFDsI=
=oJlV
-----END PGP SIGNATURE-----
Technical Details
Message-ID: <40dbef73$0$286$19deed1b@news.inter.NL.net>
Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!news.glorb.com!news-out2.kabelfoon.nl!83.128.0.10.MISMATCH!newsfeed.kabelfoon.nl!195.129.110.21.MISMATCH!bnewsfeed00.bru.ops.eu.uu.net!bnewsinpeer00.bru.ops.eu.uu.net!bnewspost00.bru.ops.eu.uu.net!emea.uu.net!news.inter.NL.net!not-for-mail
References: <40dbbfe6$0$43451$e4fe514c@news.xs4all.nl> <5016282.TPzYSbcaHM@127.0.0.1>

Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 113446,50e18526a1b1cee7
X-Google-Attributes: gid113446,public
Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!news.glorb.com!news-out2.kabelfoon.nl!83.128.0.10.MISMATCH!newsfeed.kabelfoon.nl!195.129.110.21.MISMATCH!bnewsfeed00.bru.ops.eu.uu.net!bnewsinpeer00.bru.ops.eu.uu.net!bnewspost00.bru.ops.eu.uu.net!emea.uu.net!news.inter.NL.net!not-for-mail
Date: Fri, 25 Jun 2004 11:25:15 +0200
From: Jan Reilink <janreilink@vevida.nl>
Organization: VEVIDA Nederland BV
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax)
X-Accept-Language: en-us, en
MIME-Version: 1.0
Newsgroups: be.comp.security
Subject: Re: [ISC diary] Russian IIS Hacks - yet another technique for spreading
 and installing "spamware"
References: <40dbbfe6$0$43451$e4fe514c@news.xs4all.nl> <5016282.TPzYSbcaHM@127.0.0.1>
In-Reply-To: <5016282.TPzYSbcaHM@127.0.0.1>
X-Enigmail-Version: 0.76.8.0
X-Enigmail-Supports: pgp-inline, pgp-mime
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Lines: 51
Message-ID: <40dbef73$0$286$19deed1b@news.inter.NL.net>
NNTP-Posting-Host: 32-9.bbned.dsl.internl.net
X-Trace: 1088155507 news.inter.NL.net 286 82.215.9.32
X-Complaints-To: abuse@inter.NL.net