New Worm Targets Sasser-Infected Systems

Researchers at managed-security-services provider LURHQ Corp. say they've discovered a new worm they've dubbed Dabber.

Dabber is targeting only systems infected with the Sasser worm, and, according to Joe Stewart, senior security researcher at LURHQ's Threat Intelligence Group, the worm hasn't infected many systems yet. "We're seeing one or two scans an hour," he said Thursday.

What's unusual about the Dabber worm is that it's not using an operating-system vulnerability to spread itself. Instead, it's using a vulnerability within the Sasser worm to attack and infect systems.

Once a system is infected with Dabber, Stewart says, the new worm takes steps to remove the Sasser worm as well as viruses. It also sets up a server for itself to send its code to new targeted systems and sets up a backdoor that listens for commands on TCP port 9898.

Stewart says Dabber uses exploit code that was recently released on the Internet and can be used to attack a buffer-overflow flaw within Sasser's File Transfer Protocol server.