Worm spreads via RDP
It’s retro day in the world of Internet security, with an Internet worm dubbed “Morto” spreading via the Windows Remote Desktop Protocol (RDP).
F-Secure is reporting that the worm is behind a spike in traffic on Port 3389/TCP. Once it’s entered a network, the worm starts scanning for machines that have RDP enabled. Vulnerable machines get Morto copied to their local drives as a DLL, a.dll, which creates other files detailed in the F-Secure post.
SANS, which noticed heavy growth in RDP scan traffic over the weekend, says the spike in traffic is a “key indicator” of a growing number of infected hosts. Both Windows servers and workstations are vulnerable.
SANS is soliciting copies of the worm for analysis. Since worms have become something of an anachronism in an era of for-profit attacks using botnets, that analysis will probably include asking the question “why bother?”
The first traffic spike was discussed by SANS early in August, but since then, the group is reporting that the spike has grown “tenfold”.
F-Secure also fingers jaifr.com and qfsl.net as servers being used to remotely control the Morto worm. ®
Article source: http://go.theregister.com/feed/www.theregister.co.uk/2011/08/28/morto_worm_spreading/