new (?) exploit I believe you're not testing for...

Hi Guys,

I was contacted last last week at $orkplace by Det. Mark Kelly from San
Diego computer crimes unit (verified) regarding 45 compromised machines
discovered in our (academic) network.

In these discussions it emerged that there is a romanian gang
specialising in using unsecured port 6000 snooping (xwindows) to harvest
keystrokes, gathering host/login/password information, then using that
information to login and setup zombies.

Det Kelly became involved when one of the local universities called in
the police after discovering several hundred compromised machines.

He has discovered at _least_ 40,000 compromised machines were abused in
this way since January. According to Det. Kelly the FBI has been
tracking the gang for at _least_ 2 years, so one can assume there are
thousands more hosts involved.

Apparently access to the zombies is being used for the following purposes:

1: Selling IRC bot access, primarily on Undernet network.
2: DDoS attacks
3: Phishing attacks (webservers, NSes and spam sending)

The logins are executed using genuine accounts with compromised
passwords, so no evidence of cracking would show up.

The zombie program names are obscured (misdirection based on name,
nothing more)

No attempts are made to install rootkits or tweak logfiles. Presumably
this is done in order to attract less attention. However this means that
an affected user's account will show odd login locations if checked.

Summary: I believe that checking for unsecured port 6000/Xindows should
be a new Blitzed OPM test. It's been well known for over a decade that
an open port (user running "xhost +") allows keystroke sniffing attacks,
however I believe this is the first instance of widespread abuse of the
possibility.

Regards
Alan Brown

-- 
      If a person, or organisation, starts to play on your fears
      it may be that person or organisation that you should fear.