Fergie's Tech Blog

Rinbot Just Won't Go Away

Gregg Kiezer writes on ComputerWorld:

The Rinbot worm continues to pester and plague enterprises, several security organizations said, even as Symantec Corp. declared that its honeypot network had captured traffic showing that a botnet was spreading the malware.

Rinbot is an on-again, off-again threat that exploits a pair of long-patched vulnerabilities -- one in Microsoft Windows' Server Service fixed in August 2006, the other in Symantec's own Client Security and Symantec AntiVirus software, which were patched in June. Rinbot was last in the news a week ago when systems at Turner Broadcasting System, part of Time Warner and the parent of cable news channel CNN, were reportedly attacked by Rinbot. The worm is also known as Delbot.

Shirley Powell, a spokeswoman for Turner, declined to identify the exploit that hit the company's network. But she confirmed in an e-mail that "we have been hit by a virus." The impact was minimal, but "repairs are ongoing," she said.

More here.

Also: My friend & colleague, Jose Nazario over at Arbor Networks, has done an excellent write-up on Rinbot here.

posted by Fergie @ 3/07/2007 01:30:00 PM