Article View: be.comp.security
Article #791Re: [ISC diary] Russian IIS Hacks - yet another technique for spreading and installing "spamware"
From: Jan Reilink
Date: Fri, 25 Jun 2004 09:25
Date: Fri, 25 Jun 2004 09:25
50 lines
3010 bytes
3010 bytes
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Filbert wrote: | Jan Reilink wrote: | |>-----BEGIN PGP SIGNED MESSAGE----- |>Hash: SHA1 |> |>Tijd om je IIS servers (extra) in de gaten te houden: |> |><http://isc.incidents.org/diary.php?date=2004-06-24> |>"Thanks to everybody who generously provided updates to us today. We still |>do not know how the IIS servers are originally infected with the |>JavaScript or the modification to the configuration files. Any additional |>theories or ideas are welcome. |> |>The reason for the attack seems to point back to the spamming community. |>There is quite a bit of evidence that what we are seeing is yet another |>technique for spreading and installing "spamware" (software that assists |>in either creating, relaying, proxying, or otherwise participating in the |>sending of spam.) We don't see any evidence that this attack is related to |>the construction of a DDoS network or other type of typical zombie-based |>attack group. However, we continue to monitor and will provide updates if |>anything further develops. |> |>[...]" [...] | Ook even hier gezet, Jan. | Jan Ehrhardt sprak in nl.internet.misbruik: | Er staat ook al een (alarmerend) verhaal op WebWereld: | http://www.webwereld.nl/nieuws/18890.phtml - -- Met vriendelijke groet / Best regards, Jan Reilink, VEVIDA Nederland BV Postbus 329, 9700 AH GRONINGEN, +31(0)50 - 5492234 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Netscape - http://enigmail.mozdev.org iD8DBQFA2+97yExGSa/qny0RAskYAJ0VI/RzKPwB61DvNZT7leGpLQIV9gCfTVh0 l3ri56QafRCutsKbRLjFDsI= =oJlV -----END PGP SIGNATURE-----
Technical Details
Message-ID:
<40dbef73$0$286$19deed1b@news.inter.NL.net>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!news.glorb.com!news-out2.kabelfoon.nl!83.128.0.10.MISMATCH!newsfeed.kabelfoon.nl!195.129.110.21.MISMATCH!bnewsfeed00.bru.ops.eu.uu.net!bnewsinpeer00.bru.ops.eu.uu.net!bnewspost00.bru.ops.eu.uu.net!emea.uu.net!news.inter.NL.net!not-for-mailReferences:
<40dbbfe6$0$43451$e4fe514c@news.xs4all.nl> <5016282.TPzYSbcaHM@127.0.0.1>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: 113446,50e18526a1b1cee7 X-Google-Attributes: gid113446,public Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!news.glorb.com!news-out2.kabelfoon.nl!83.128.0.10.MISMATCH!newsfeed.kabelfoon.nl!195.129.110.21.MISMATCH!bnewsfeed00.bru.ops.eu.uu.net!bnewsinpeer00.bru.ops.eu.uu.net!bnewspost00.bru.ops.eu.uu.net!emea.uu.net!news.inter.NL.net!not-for-mail Date: Fri, 25 Jun 2004 11:25:15 +0200 From: Jan Reilink <janreilink@vevida.nl> Organization: VEVIDA Nederland BV User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax) X-Accept-Language: en-us, en MIME-Version: 1.0 Newsgroups: be.comp.security Subject: Re: [ISC diary] Russian IIS Hacks - yet another technique for spreading and installing "spamware" References: <40dbbfe6$0$43451$e4fe514c@news.xs4all.nl> <5016282.TPzYSbcaHM@127.0.0.1> In-Reply-To: <5016282.TPzYSbcaHM@127.0.0.1> X-Enigmail-Version: 0.76.8.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Lines: 51 Message-ID: <40dbef73$0$286$19deed1b@news.inter.NL.net> NNTP-Posting-Host: 32-9.bbned.dsl.internl.net X-Trace: 1088155507 news.inter.NL.net 286 82.215.9.32 X-Complaints-To: abuse@inter.NL.net