Malicious Worms Still Probing LSASS Vulnerability

Three versions of the Korgo worm have appeared this week, all exploiting the LSASS flaw within Windows that was disclosed and patched in mid-April.

Korgo.a, Korgo.b, and Korgo.c all scan for unpatched systems -- like Sasser, the first worm that used this hole in Windows, Korgo doesn't arrive via e-mail -- and when one is detected, open a backdoor and upload their payload.

Also known as Padobot, Korgo "chooses the IP-addresses of random machines to infect and attack, similar to other worms which exploit the same LSASS vulnerability," said Finnish security firm F-Secure in an advisory.

The worms open a variety of TCP ports, including 113, 445, 2041, 3067, and 6667 as a back door, then communicates with a variety of Internet Relay Channel (IRC) servers for further commands and to receive data. Once compromised, the worm may allow attackers to gain full control of the system.

Sponsored post

Although the Korgo line has been dubbed a minor threat by virtually all anti-virus firms -- Symantec, for instance ranked the three as a "2" in its 1 through 5 assessment scale -- F-Secure noted that Korgo "seems to be stealing user information very aggressively through keylogging techniques."

F-Secure's analysis points to a Russian hacker group -- dubbed the "Hangup Team" -- as the probable creator of Korgo.

Even though this new mini-wave of worms is not spreading particularly fast, security firms again urged users to make sure that their Windows NT, 2000, XP, and Windows Server 2003 systems are patched against the LSASS vulnerability.

The patch can be downloaded from Microsoft's Windows Update Web site or directly from here.

*This story courtesy of