Worm Targets October Windows Flaw
The first worm that successfully attacks an October vulnerability in Microsoft Windows was spotted in the wild Thursday, a pair of security organizations said.
Both F-Secure and the SANS Institute's Internet Storm Center (ISC) said that the worm, dubbed Dasher.b, had been nabbed by the Honeypot Project, a German group that deploys exposed PCs to attract malicious code and capture samples. The worm exploits the MSDTC vulnerability disclosed by Microsoft in its October patch batch.
In late November, Microsoft issued a security advisory that acknowledged proof-of-concept code against the MSDTC bug was circulating, but said that the code couldn't actually execute remotely.
Dasher.b, however, uses that proof-of-exploit code to infect Windows 2000 and XP PCs, and then to download a keylogger from a remote server. The keylogger is cloaked by a rootkit, said F-Secure in an online alert. As of mid-Thursday, the remote server was online and operating.
