The sound of thunder heard on the Internet today: New Trojan!

www.eweek.com...

June 13, 2003
New Breed of Trojan Raises Security Concerns
By�Dennis Fisher

"Security researchers believe they have identified a new breed of Trojan horse that is infecting machines on the Internet, possibly in preparation for a larger coordinated attack.

"However, experts have been unable to pin down many of the details of the program's behavior and are unsure how many machines might be compromised by the Trojan."


I've been hearing about something big in the works... this might be it. Hold on to your hard drives... this one might be trouble.

Damn. Thanx for the heads up William. Is there anyway to check if you have that trojan in your system. I've done the usual scans and checks for trojans and spyware I usually do and it says my machine is clean. However is these trojans are new then the current software may not be up to task. Keep us informed.

Any info if the normal firewall/antivirus software has updates or patches for this yet? (Macafee/Norton, ect)?

Nothing new yet.

This is late-breaking news on what seems to be a brand new nasty.

Additionally, this fits the profile of what has been theorized as the precursor to a large scale Internet attack. This could be very ugly, or nothing... with little change for something in-between.

Odd things online tonight.

Other system admins are reporting an increase in attempted UDP and TCP floods tonight. My firewall has caught and blocked three separate attacks in just the past two hours (since last weeks attack, I upgraded, and figured out how to program it to recognize flood attempts and automatically block the flooding IP, then send me an e-mail).

Another odd thing... the Apple website was down for more than an hour... it's never down.

more as we know it

I'm having serious bandwidth issues, i believe my ISP is under attack also, i keep cutting off every 30 mins...and i'm on cable dammit!

Tomorrow they'll be getting disgruntled phone calls.

[Edited on 19-6-2003 by David]

William:

Any specific region where these are coming from?

One of the attacks was from a user on David's ISP (different class-C).

The other two from China.

Both were UDP floods... and the UK user was on a dial-up connection... UDP flood from a dial-up user means they've been infected by a trojan.

so... simple inconsistencies within an isp's connectivity with it's client can be a sign of this new trojan?

Oh, wow, thanks for sharing. I did notice my internet connection was rather throttled. Of course I noticed that because I was downloading files all day... Hmm, we will see just what I downloaded in a day or two. Apple's site was down? Must be an unrelated coincidence.