photominer worm spreads via insecure ftp servers

Spitzner also said the worm could have been far more dangerous. 'Since it is automated, it can quickly scan for and exploit vulnerable systems at an exponential rate (that makes) the most dangerous element of this worm bandwidth consumption.' 'The worm is dangerous in that it is an automated tool that exploits widely known vulnerabilities,' said Honeynet's Spitzner. Both Web accounts-one at Hotmail and one at Yahoo-seem to have been frozen. When the Ramen worm gains access, it installs a so-called root kit that patches the security holes and installs special programs that replace common system functions and replace the main page on Web servers with an HTML file claiming: 'RameN Crew - Hackers looooooooooooove noodles.'įinally, the new worm sends an e-mail message to two Web-based accounts, boots up and starts scanning the Internet again. Known as a buffer overflow, or overrun, such exploits are commonly used in scripts designed by system crackers. The worm attempts to compromise Red Hat 7.0 systems by swamping the error logging function of the server's printer service with data. Red Hat's distribution of Linux accounts for almost 70 percent of all Linux servers on the Web, according to data from Web survey firm. Patches for both flaws have been readily available for more than six months.

But because the worm limits itself to Red Hat servers, those distributions are not affected. Washington University's version of the common file server, known as wu-FTP, has a flaw that also allows access.īoth flaws appear in other distributions of Linux, including SuSE, Mandrake and Caldera. RPC.statd is one of several services that a Linux server can run to offer remote access using a common suite of programs known as remote procedure calls. Wu-FTP flaws, according to an analysis completed by Daniel Martin, a Debian Linux developer. When trying to infect Red Hat 6.2 systems, the worm will use the RPC.statd and The worm spreads by scanning the Internet for servers based on Red Hat 6.2 or 7.0-identifying the servers by their release dates-and then attempts to gain access using several methods.

Spitzner, Moldovanu and other security experts on 's Incidents mailing list detected the worm earlier this week when they noticed an increase in scans for two common flaws that plague the default installations of most Linux servers. 'Most default installations are insecure,' he stressed. 'Not enough people are taking measures to secure the default installations. 'It's a lack of awareness,' said Lance Spitzner, coordinator for the Honeynet Project, a group of well-known security experts who study how hackers attack servers. The worm exploits several well-known flaws on Linux servers based on the default installation of versions 6.2 and 7.0 of Red Hat's distribution of Linux. As of Wednesday afternoon, the worm continued to spread.

'The scanning is very fast.'Īccording to Moldovanu, the worm scanned two B-class networks-about 130,000 Internet addresses-in less than 15 minutes. 'Once the worm starts scanning, it will consume a large amount of your Internet bandwidth,' said the programmer. 'The worm itself seems dangerous due to bandwidth consumption and due to the (unproven) possibility of remotely accessing the compromised box by the worm author,' said Mihai Moldovanu, a Romanian network administrator for Radio ProFM Bucharest, who reverse-engineered much of the worm Tuesday. Known as the Ramen worm, the self-spreading program appears to have been created by common Internet vandals-called script kiddies-and limits itself to infecting Red Hat servers that haven't been secured properly. An Internet worm cobbled together from generally available hacking tools could swamp infected portions of the Net with its high-bandwidth searches for vulnerable servers, researchers said Wednesday.

Photominer worm spreads via insecure ftp servers