Summary: Rise in Windows traffic on the Internet, but not the desirable type of traffic (RDP attacks)

Check out this piece of news: [via]

It’s retro day in the world of Internet security, with an Internet worm dubbed “Morto” spreading via the Windows Remote Desktop Protocol (RDP).

F-Secure is reporting that the worm is behind a spike in traffic on Port 3389/TCP. Once it’s entered a network, the worm starts scanning for machines that have RDP enabled. Vulnerable machines get Morto copied to their local drives as a DLL, a.dll, which creates other files detailed in the F-Secure post.

SANS, which noticed heavy growth in RDP scan traffic over the weekend, says the spike in traffic is a “key indicator” of a growing number of infected hosts. Both Windows servers and workstations are vulnerable.

Bravo, Microsoft. ⬆

Update: Incidentally, Nokia's developer network has just been cracked. Based on some tests, the site runs Windows. Netcraft says it ran Windows, but it is now hiding behind Akamai (Linux). Some case sensitivity tests seem to confirm that It runs Windows.