August 29th, 2011, 17:56 PM
New Windows worm spreads by attacking weak passwords
A new Windows worm is working its way through company networks by taking advantage of weak passwords, security researchers said over the weekend.
The worm, dubbed "Morto" by Microsoft and Helsinki-based F-Secure, has been circulating since at least last week, when company administrators noticed systems generating large numbers of unexplained connections to the Internet.
According to Microsoft, Morto is the culprit.
"Although the overall numbers of computers reporting detections are low in comparison to more established malware families, the traffic it generates is noticeable," said Hil Gradascevic, a researcher with the Microsoft Malware Protection Center (MMPC), in a Sunday blog.
Morto spreads using RDP, or Remote Desktop Protocol, the Microsoft-made protocol for controlling one computer by connecting to it from another.
All versions of Windows from XP on include client software that uses RDP to remotely access machines. The software, called Remote Desktop Connection (RDC) in XP, Vista and Windows 7, requires a username and password to log in to a remote system.
Windows PCs infected with Morto scan the local network for other machines that have RDC switched on, then try to log in to a Remote Desktop server using a pre-set list of common passwords, said F-Secure. If one of the passwords works, the worm then downloads additional malware components to the just-victimized server and kills security software to remain hidden.
Full story: Computerworld