The backdoor component of W32/Rbot-GR may be used to:
 
    * Initiate distributed denial-of-service (DDOS) attacks using ICMP, SYN and UDP.
    * Redirect TCP and SOCKS4 traffic.
    * Provide a remote login shell.
    * Download, upload, delete and execute files.
    * Set up an HTTP and TFTP file server.
    * Steal passwords (including PayPal account information).
    * Log key presses.
    * Capture screenshots.
    * Capture webcam screenshots and videos.
    * List and kill processes.
    * Open and close vulnerabilities.
    * Port scan for vulnerabilities on other remote machines.
    * Send emails as specified by the remote user.
    * Flush the DNS and ARP caches.
    * Shut down the machine.

This worm has backdoor capabilities. It has a built-in IRC client engine, which enables it to connect to a remote IRC server and channel. It then listens for commands from the remote user. It is able to receive the following mIRC commands from a remote user to process on the host machine:
 
    * Change IRC server and channel where it connects to
    * Download and execute files
    * Flushes DNS cache
    * Add/remove default network shares
    * Enable DCOM protocol
    * Get system information (i.e., CPU speed, free memory, uptime, free disk space)
    * Delete files
    * Emulate an FTP server
    * List and terminate services and processes
    * Scan local area network for listening ports
    * Emulate a proxy server
    * Redirect connections
    * Logs keystrokes
    * Obtain screenshots

La particularité de cette version Rbot-GR réside dans sa capacité de prendre le contrôle du microphone et de la   webcam, puis d'envoyer les enregistrements sonores et vidéos aux pirates.

Le nombre de machines infectées par    Rbot-GR     reste très faible, car les vulnérabilités exploitées sont connues et patchées depuis plusieurs mois : [WebDav (MS03-007), RPC DCOM (MS03-039, MS04-012), UpNP (MS01-059)]. Les autres faiblesses utilisées par le ver sont : IPC (faiblesse des mots de passe Windows), MSSQL Null-Password, DameWare Overflow (CAN-2003-1030), ainsi que les portes dérobées laissées ouvertes par d'autres vers et chevaux de Troie tels que W32/MyDoom, Troj/Optix, Troj/Kuang et Troj/NetDevil.

Vmyths.com Virus Hysteria Alert
Truth About Computer Security Hysteria
{25 August 2004, 01:20 CT}
 
CATEGORY: Dire predictions of a cyber-war or cyber-terrorism
 
Russian news site MosNews.com has reported "terrorists will paralyze the
Internet on August 26" (this Thursday).  The story cites virus experts
Alexander Gostev and Eugene Kaspersky, both who work for Kaspersky Labs, a
large Russian antivirus firm.  MosNews ran the story under the headline
"Russian Computer Expert Predicts Internet Terrorist Attack."
 
   MosNews.com story (English):
   http://www.mosnews.com/news/2004/0 [...] tend.shtml
 
The web page address includes the phrase "internetend" -- an obvious
reference to the end of the Internet as we know it.
 
Vmyths dismisses this "Internet Terrorist Attack" story as baseless
hysteria, for numerous reasons explained below.
 
It appears MosNews derived their story from a newswire published by
Lenta.ru, which may have derived their own story from a Novosti newswire.
In other words, it's "hand-me-down" news, and this is a systemic problem in
computer security.  Reporters will often quote each others' stories as their
main sources of information.  Worse, these stories originated in Russia,
where many news agencies have dissolved into sensationalist tabloids since
the breakup of the Soviet Union.
 
Speaking directly to Novosti's reporters, Gostev supposedly claimed "the
United States and Western Europe will suffer from the attack" on Thursday,
while Kaspersky supposedly "reminded that similar attacks had earlier
paralyzed [the] Internet in South Korea.  He added that it would be
'impossible' to stop terrorist organizations if they 'get down to
business.'"
 
As expected, the Novosti newswire described the cyber-terrorists as
"Islamic" fundamentalists who declared Thursday a day of "electronic jihad."
 
Gostev and Kaspersky claimed they learned about the cyber-terror attack from
data "published on specialized sites," and Gostev admitted "it is difficult
to say how true this information is."  Statements like this raise a RED FLAG
at Vmyths.  We believe the men studied messages left by narcissistic
braggarts, not Islamic cyber-warriors.  Vmyths has seen NO objective
corroborating evidence for an Internet armageddon in the near future.
 
Narcissistic braggarts have a notorious habit of (1) declaring an attack
date and then (2) failing to show up for duty at the appointed time.  One of
the most hilarious examples of this took place in 1997; see
http://Vmyths.com/hoax.cfm?id=28&page=3 for details.
 
According to Novosti, Kaspersky concluded by saying "it is ghastly enough
that these people have mentioned 'electronic jihad' for the first time."
Kaspersky is clearly mistaken if the newswire quoted him in context.
Hackers and the media have used this exact term for years; a Google search
returns 500+ matches.  Israel's Jerusalem Post newspaper used a similar
term, "virtual jihad," four years ago.  mi2g (a well-documented fearmonger)
has issued predictions over the years for electronic jihads which have NEVER
come to pass.
 
   Remember this when virus hysteria strikes:
   http://Vmyths.com/resource.cfm?id=31&page=1
 
MosNews quoted Lenta.ru, which quoted another virus expert, who insisted
"Kaspersky Labs has been foretelling the doomsday for a long time."  Vmyths
agrees they occasionally sensationalize threats -- but a global cyber-terror
prediction seems highly out of character for them.  And the Kaspersky.com
website so far offers no special news/advice for its clients.  The Novosti
newswire oddly claims Kaspersky Labs "will be switched over to the 'yellow'
danger level" on Thursday, but this, too, seems highly out of character for
the antivirus firm.
 
For all of these reasons, Vmyths dismisses this "Internet Terrorist Attack"
story as baseless hysteria.
 
Vmyths assumes Alexander Gostev & Eugene Kaspersky were quoted out of
context -- but we don't know HOW MUCH they were quoted out of context.  This
may be an example of a "worst-case scenario briefing" gone awry.  (See
http://Vmyths.com/rant.cfm?id=540&page=4 for more on this subtopic.)  We
asked Kaspersky Labs to comment on the Russian news stories and we'll
publish their response as soon as we get it.
 
Unfortunately, the global media has a FETISH for "end of the Internet"
stories.  Vmyths predicts the following:
 
   (1) On Wednesday, news outlets around the world will report the Novosti
newswire (and stories derived from it) without question.  A sensationalist
reporter might even link cyber-terrorism to the breaking news of two Russian
jetliners that just crashed.  "Did Islamic hackers take over the cockpits?"
   (2) On Thursday, a few news outlets will acknowledge the prediction
flopped.
   (3) On Friday, reporters will dump the story as a non-event.
 
The SANS "Internet Storm Center" (http://isc.sans.org) currently reports a
"green" status for the Internet.  SANS "predicts that the Internet will not
vaporize into a cloud of nothingness this Thursday, but if it does, it's
been our pleasure to help stave off its inevitable annihilation this long."
Vmyths applauds SANS for its sense of humor.
 
Don't bet on an Islamic cyber-attack this Thursday.  Stay calm.  Stay
reasoned.  And stay tuned to Vmyths.
 
Rob Rosenberger, editor
http://Vmyths.com
Rob@Vmyths.com
(319) 646-2800
 
Acknowledgements:
  * Cory Altheide (SANS), for URLs to Russian news stories
  * Confidential source, for the Novosti newswire
 
CATEGORY: Dire predictions of a cyber-war or cyber-terrorism

Une vulnérabilité a été identifiée dans plusieurs produits Symantec,
elle pourrait être exploitée par un attaquant distant afin de causer
un Déni de Service. Ce probleme résulte d'une erreur présente au
niveau du service isakmpd. Aucune détail technique n'a été publié.
 
Versions vulnérables :
Symantec VelociRaptor 1.5
Symantec Gateway Security 1.0
Symantec Gateway Security 2.0
Symantec Enterprise Firewall/VPN 7.0 for Solaris
Symantec Enterprise Firewall/VPN 7.0 for Windows NT/2000
Symantec Enterprise Firewall/VPN 7.0.4 for Solaris
Symantec Enterprise Firewall/VPN 7.0.4 for Windows NT/2000

K-OTik Security has received since July 22nd several reports from
users who were hacked on IRC. This 0day attack had been used to spread
spyware and trojans, infecting a computer after the victim clicked on
a fake winamp skin web link.
 
We confirmed this flaw on fully patched systems running the latest
version of Winamp, and reported today this flaw/exploit to avers.
 
we decided today to make this exploit "public". There is no patch for
this vulnerability -> do NOT use Winamp.

Depuis le 22 Juillet 2004, nous avons reçu plusieurs rapports
d'incidents concernant l'exploitation d'une vulnérabilité encore
inconnue. Les investigations de la Cellule Veille de K-OTik.COM ont
démontré l'existence d'un exploit de type zero-day (dit "privé" )
utilisé par quelques sites malicieux installant automatiquement des
trojan et spywares sur des machines vulnérables. Afin de protéger
les utilisateurs des risques liés à cette vulnérabilité critique,
les détails techniques sont désormais publics.

If I may be so bold, this is nonsense.  First off, any
ankle-biting scriptkiddy knows that network outages do not evoke a sense
of terror.  Such events evoke nothing but annoyance.
 
 Secondly, any such network-wide outage would require the DoS'ing
or destruction of all network root servers.  That's been attempted before
and was a spectacular failure from the perspective of the attacker.
 
 Finally, Islamic terrorists do NOT trust high technology vectors
for their attacks.  Their "smart bombs" are suicide bombers (as used
across the globe); their "torpedoes" (like what hit the USS Cole) are
bomb-laden boats with suicide captains; their "guided missiles" on 9/11
were our own aircraft with suicide pilots.  The pattern here is obvious:
their attacks are either low-tech or no-tech.  This does not give them
much credibility in terms of "cyber warfare" (sic).
 
 If you ask me, I'd say the Russian news agency in question either
has a technologically-ignorant or positively incompetent reporter who's
been hoodwinked by some fast-talking scriptkiddies.

En se connectant au site www.wanadoo.com, l'internaute était redirigé vers d'autres sites qui essayaient d'installer sur sa machine un cheval de Troie. Le programme utilisait pour cela deux failles logicielles connues, Exploit-ByteVerify et MHTML URL.

Nullsoft has issued a fix for this critical vulnerability affecting Winamp 3.0, 5.0 and 5.0 Pro or newer.
 
Nullsoft said that Winamp 5.05 resolves this exploit in two ways:
 
- Winamp will now prompt all users with a confirmation window before installing any skins.  
 
- Winamp will now only extract files considered low risk before loading a Winamp Skin.  
 
ALL Winamp users MUST upgrade to Winamp 5.05 immediately.  
 
http://www.winamp.com/player/
 
Regards.K-OTik.COM Security Survey Team http://www.k-otik.com