Hi. Guille -bisho- wrote: [bugtraq list quote]
After the program "/tmp/.bugtraq" starts running, it becomes a member of a virtual network. Network members comunicate using UDP port 2002.The program can, when instructed (using udp port 2002):
[/bugtraq list quote]
In 3 dias, about 1500 diferent IP address tried to contact my machine at UDP port 2002. Fortunally i have iptables configured.
We experienced the same here. The peak was at about 4 MBit/s traffic which was the limit of the line the server is connected to. Now, after the bugtraq-process is not running anymore for longer than 24 hours still packets for port 2002 are fired against the server's ip address. I guess that the client implements some kind of cache for addresses of infected servers so that they can be contacted for giving them new orders. Maybe "our" ip is still in the cache.
Any idea about the outgoing connections to port 80? We noticed that the bugtraq-process systematically tries to connect to port 80 in an ip block, and it keeps trying and trying, incrementing the ip addresses by one per step (1.2.3.4, 1.2.3.5, 1.2.3.6, and so on). We could not find out what is done with this connection, nor what the purpose of this "scan" is.
Bye, Mike