New Breed of Trojan Raises Security Concerns

***Zardon*** · Jun 16, 2003, 05:32 PM

Security researchers believe they have identified a new breed of Trojan horse that is infecting machines on the Internet, possibly in preparation for a larger coordinated attack.
However, experts have been unable to pin down many of the details of the program's behavior and are unsure how many machines might be compromised by the Trojan.

The program scans random IP addresses and sends a probe in the form of a TCP SYN request with a window size that is always 55808. Infected hosts listen promiscuously for packets with certain identifying characteristics, including that specific window size. Experts believe that other fields within the packet's header probably give the infected host information on the IP address of the controlling host and what port to contact the host on.

More at eweek

Monkeyboy · Jun 16, 2003, 07:31 PM

Call this paranoia if you like, but has anyone else thought this might be one of the 'sabotage' viruses that the RIAA has supposed to have commissioned?

The fact that the code does not contain a central 'phone-home' address suggests that it would be particularly suited to P2P networks.....

Jun 16, 2003, 05:32 PM	#1
*Zardon* enchanted Join Date: May 2002 Location: Driverheaven Posts: 32,255 Rep Power: 3150	New Breed of Trojan Raises Security Concerns Security researchers believe they have identified a new breed of Trojan horse that is infecting machines on the Internet, possibly in preparation for a larger coordinated attack. However, experts have been unable to pin down many of the details of the program's behavior and are unsure how many machines might be compromised by the Trojan. The program scans random IP addresses and sends a probe in the form of a TCP SYN request with a window size that is always 55808. Infected hosts listen promiscuously for packets with certain identifying characteristics, including that specific window size. Experts believe that other fields within the packet's header probably give the infected host information on the IP address of the controlling host and what port to contact the host on. More at eweek

Jun 16, 2003, 07:31 PM	#2
Monkeyboy DriverHeaven Lover Join Date: Aug 2002 Location: Vista: the woe starts now! Posts: 113 Rep Power: 0	Call this paranoia if you like, but has anyone else thought this might be one of the 'sabotage' viruses that the RIAA has supposed to have commissioned? The fact that the code does not contain a central 'phone-home' address suggests that it would be particularly suited to P2P networks.....