p2pnet.net News:- A 16-year-old Canadian from Ontario described in a newspaper report as a, “teenage spam artist suspected of hacking into thousands of computers,” has been charged with mischief and fraudulent use of a computer, among other things.

The youth used the Randex worm to hack into local systems, says a London Free Press story here, going on:

“Officers working out of headquarters here tracked a variant of the well-known Randex virus, which had weaved into the computers of more than 9,000 unsuspecting internet users through such popular file-sharing programs as Kazaa.”

The story says Royal Canadian Mounted Police Sgt George Wiegers wouldn’t discuss the specific case, “but said generally such commands force infected computers to send spam - unsolicited bulk e-mails - to a single computer at once. Such a move could cause the targeted computer to crash, Wiegers said.”

Randex is an IRC controlled worm, based on the SdBot IRC backdoor, says F-Secure here.

It has a list of passwords it uses to get into poorly protected Windows accounts, says F-Secure, going on that if a password lets the hacker in, Randex copies itself to:

‘c$winntsystem32msmonk32.exe’
‘Admin$system32msmonk32.exe’

When the files are in place the worm schedules a remote job to run itself on the remote computer.

“The backdoor component provides the usual set of functionality which is controlled through a predefined IRC channel,” says F-Secure, adding that by issuing commands on the control channel, the remote attacker can:
- get info on the system
- set different parameters in the bot
- download arbitrary files to the computer
- execute programs on the computer
- etc

This entry was posted on Thursday, May 27th, 2004 at 12:56 pm and is filed under Uncategorized. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

HOME

Viewed 1368 times