Sadmind/IIS Defacement Worm Strikes Quote.com Site

An Internet worm that automatically defaces Web sites claimed another high-profile victim today, redecorating the home page of a site operated by Lycos' Quote.com investment service. The Sadmind/IIS worm replaced the home page of Quote.com's Virtual Advisor Portfolio Tracker site with its trademark anti-American message in red letters on a black background. The defacement was still viewable this morning.

Since May, more than 300 similarly defaced sites have been logged by the Safemode defacement archive. All were running unpatched versions of Microsoft's Internet Information Server (IIS) software, according to port scans conducted by the archive service....

Defacement Worm Strikes Quote.com Site

By Brian McWilliams, Newsbytes WALTHAM, MASSACHUSETTS,

The free Virtual Advisor service, located at http://vaweb.quote.com , enables investors to track their investments online but does not allow trading of securities or other financial instruments.

A Lycos spokesperson told Newsbytes that the company is investigating the security breach and had no immediate comment.

Other prominent companies with servers infected by the worm include Informix Corp. and Upside Media, according to Safemode records.

In a list of frequently asked questions at the Virtual Advisor site, users are advised to log off when finished using the service, "so that your private financial information is not visible to someone else who might later use your computer."

The Virtual Advisor site is operated by Quote.com in partnership with Advisor Software of Lafayette, Calif.. The firm provides consulting services to financial industry clients including Fidelity Investments, TIAA-Cref, and Dow Jones News Service.

The Safemode archive of sites defaced by Sadmind/IIS is at

http://www.safemode.org/records/sysadmcn.html .

The CERT advisory about the worm is at

http://www.cert.org/advisories/CA-2001-11.html .

Reported By Newsbytes.com, http://www.newsbytes.com .