Morto worm surprises again
Posted on 02.09.2011
Bookmark and Share
As it turns out, the recently discovered Morto worm that has been spreading in the wild has more than one never-before-seen characteristic.

Not only does it spread by using the Remote Desktop Protocol, but it also uses a novel way to contact its C&C in search for instructions: via DNS (Domain Name System) TXT records.

"While examining W32.Morto, we noticed that it would attempt to request a DNS record for a number of URLs that were hard-coded into the binary," writes Symantec's security response engineer Cathal Mullaney.

"This is by no means unusual or unique, but when we examined the URLs, we noticed that there were no associated DNS A records returned from our own DNS requests. On further investigation, we determined that the malware was actually querying for a DNS TXT record only – not for a domain to IP lookup – and the values that were returned were quite unexpected."

All in all, the information provided was a binary signature and an IP address from which the worm can download further malware - the same information that most threats receive using more established communication channels.






Spotlight

Attackers use reflection techniques for larger DDoS attacks

Posted on 17 April 2014.  |  Instead of using a network of zombie computers, newer DDoS toolkits abuse Internet protocols that are available on open or vulnerable servers and devices. This approach can lead to the Internet becoming a ready-to-use botnet for malicious actors.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Thu, Apr 17th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //