427 Botnet fm qxd

Table 4.9
Vulnerabilities Exploited by Spybot Variants to Help It Propagate 
Vulnerability
Port(s)
Microsoft Security Bulletin
DCOM RPC vulnerability
TCP 135
MS03-026
LSASS vulnerability
TCP ports 135, 
MS04-011
139, 445
www.syngress.com
122
Chapter 4 • Common Botnets
Continued
427_Bot_ch04.qxt 1/9/07 3:03 PM Page 122

---

Table 4.9 continued
Vulnerabilities Exploited by Spybot Variants to Help
It Propagate 
Vulnerability
Port(s)
Microsoft Security Bulletin
SQL Server and MSDE 2000 
UDP 1434
MS02-061
vulnerabilities
WebDav vulnerability
TCP 80
MS03-007
UPnP NOTIFY buffer 
MS01-059
overflow vulnerability
Workstation Service buffer 
TCP 445
MS03-049
overrun vulnerability
Microsoft Windows SSL 
MS04-011
Library DoS vulnerability
Microsoft Windows Plug 
MS05-039
and Play buffer overflow 
vulnerability
Microsoft Windows Server 
MS056-040
Service remote buffer 
overflow vulnerability
Source: Symantec Corp. (www.symantec.com/security_response/
writeup.jsp?docid=2003-053013-5943-99&tabid=2)
Mytob
The Mytob family of worms is an example of the converging world of mal-
ware.The originators of Mytob took a mass-mailing worm and combined it
with bot functionality based on the SDBot family.The hybrid combination
results in faster propagation and more compromised systems lying dormant,
waiting for a botherder to give them direction.
Aliases
Antivirus and security vendors rarely agree on naming conventions, so the
same threat can have multiple names, depending on which vendor is sup-
plying the information. Here are some aliases for Mytob from the top
antivirus vendors: