55808 Trojan Analysis

espo812 writes "This analysis of the 55808 trojan that has been circling the internet was just posted on Bugtraq . The good news (i guess?) is that apparentally it is just a proof of concept distributed scanner. The bad news is they think they just caught a copycat version of the origional trojan. ISS also has an analysis."

Comments

Related Information

[Scoria]

Timothy published related information this morning. Perhaps "55808" is attempting to locate Slashdot duplicates. ;-)

This is quite a clever trojan

[rf0]

In that as a port scanner normally has to set the desitantion address on the packets to itself to get the results. Along with this packet it also might send out 100's of spoofs. This one on the other hand send out nothing but forged packets

However as its listening in promiscous mode it detects other packets from other trojans that have the network its on as the spoof address and the collects those results.

This is what makes its so hard to find,for one reaons

Rus

DoItYourself

[graf0z]

Analyse (like here ) the target IPs & ports for Yourself:

$ screen tcpdump -w /tmp/55808.dump -s1500 -n -i eth0 'tcp and tcp[14:2] = 55808' &

If You have enough IPs, You'll see the gimmick ...

/graf0z.

Re:It's so simple!

[tomstdenis]

1. Use the same fucking joke over and over.
2. ???
3. Jackass!

It's the Church of the Subgenius

[Bingo Foo]

Their "flagship," the S.S.BOB

Uh that's a de-leetified 55808 BTW

What's Behind This Odd Dupe?

[GillBates0]

From the BugTraq Post "The information we've been able to gather leads us to believe that the trojan we have captured is not the original source of the 55808 traffic that has been seen, but is rather a "copycat", created to mimic the behavior of another trojan or worm."

The information we've been able to gather leads us to believe that the new article we're seeing is not the original source of the odd Slashdot-generated traffic that has been seen on the Internet, but is rather a "copycat", created to mimic the behavior of another article or story.

Re:How does it spread?

[freeweed]

The big Samba exploit a couple of months ago left a nice root shell bound to a fixed high port. What's interesting about this is that *many* exploits around the same time shared the same shellcode, and thus the same port.

Doing some casual scanning at the time, I picked up hundreds of boxes with a root (or other user, local privlege escalation anyone?) shell open on that very port. This was only a couple of hours of scanning; imagine what I could have done given a few weeks.

Product Name Change

[malia8888]

Press Release: Trojan Condoms will hereinafter be called "Greeks". As any mythology student knows the Greeks and the Trojans in mythology were opponents. The Trojan Company in an effort to distance itself from the "trojans" in the cyber world will change sides in this epic conflict and now refer to their fine product as "Greeks".

Press Release Number Two: Bill's Bait Shop will now refer to their worms as "Fancy Pink Wriggling Fish Food". Bill's Bait Shop, in an effort to distance itself from the "worms" in the cyber world will now refer to their fine product as "Fancy Pink Wriggling Fish Food".