A new Trojan that has been making its way around the Internet in recent weeks continues to baffle security experts, who have been unable to get a good handle on its behavior.
The Trojan apparently made its first appearance around May 16 and began randomly scanning Internet-connected machines. The scanning was slow at first but has begun to pick up speed in recent days as more machines have become infected. Researchers at Internet Security Systems Inc. in Atlanta have been seeing nearly 3,000 scans an hour on Tuesday across the entire address space that the company monitors.
The Trojan scans random ports on random machines, each time sending an initial SYN packet. One of the few identifiable characteristics of the program is a window size of 55808 on each of the packets it transmits. It also spoofs the originating IP address on all of the packets, making them look as if theyre coming from machines in unallocated name space.
ISS has been tracking the Trojan for about a month and has yet to find a copy of its code or successfully trace it back to an infected machine. Other security vendors and officials at the Department of Homeland Security are also tracking the Trojan, all without any luck so far.
“We still dont have a good idea where its going or if its communicating with anyone,” said Pete Allor, manager of X-Force Threat Intelligence Services at ISS. “I dont want to say Im close, but Im closer than I was yesterday.”
Researchers have been frustrated by the Trojans random behavior, which has helped it elude capture. One of the few nuggets of information that experts have at this point is that a portion of the hex code in the packets the Trojan sends contains the term “day 0.” In security circles, the phrase “zero day” is often used to describe attacks on vulnerabilities that have just been discovered.
Despite the problems tracking the Trojan so far, Allor believes its only a matter of time before someone gets a handle on it. When he does find it, Allor is eager to peek into the Trojans code and see what makes it tick.
“This is a new one. It piqued our curiosity really quick,” he said.