Recent XML-RPC Worm Attacks

**Kayla** · February 23rd, 2006, 12:59 AM

We have blocked the 'common' request used by the xml-rpc worm at the network core. We noticed these requests starting to show up on our Network IDS Monitor before the buzz about the worm came about. We put a filter into place which will mitigate the attack. At this time we actually have a number of requests blocked so far, currently it's 8,618. So, it's safe to say the worm is a heavy populator even though most news sites claim it's low scale. With all of the hosts out there with old installs of Mambo (popular target) on shared servers (and doing nothing about it) that worsens the effects by far.

**Turnip** · March 4th, 2006, 4:44 PM

I have one site running Mambo, and two running Joomla...

All three have apparently been attacked in the last three days; they all return parse errors (which is the classic symptom).

I'm going about upgrading everything at the moment, with fingers and toes crossed...but your message was posted back on the 23rd of February. Today's the 4th of March...so the worm's still getting through.

February 23rd, 2006, 12:59 AM	#1 (permalink)
Kayla Marketing Maven Surpass Staff Joined in May 2003 Lives in Orlando 24,749 posts Gave thanks: 946 Thanked 806 times	Recent XML-RPC Worm Attacks We have blocked the 'common' request used by the xml-rpc worm at the network core. We noticed these requests starting to show up on our Network IDS Monitor before the buzz about the worm came about. We put a filter into place which will mitigate the attack. At this time we actually have a number of requests blocked so far, currently it's 8,618. So, it's safe to say the worm is a heavy populator even though most news sites claim it's low scale. With all of the hosts out there with old installs of Mambo (popular target) on shared servers (and doing nothing about it) that worsens the effects by far. __________________ Follow Surpass on Twitter and Facebook Check out the Surpass Blog

March 4th, 2006, 4:44 PM	#2 (permalink)
Turnip Surpass Fan Seasoned Poster Joined in Sep 2004 32 posts Gave thanks: 2 Thanked 3 times	Not quite.. I have one site running Mambo, and two running Joomla... All three have apparently been attacked in the last three days; they all return parse errors (which is the classic symptom). I'm going about upgrading everything at the moment, with fingers and toes crossed...but your message was posted back on the 23rd of February. Today's the 4th of March...so the worm's still getting through.

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)