QuestionQ160

Scanning and Mapping

John works as a Professional Ethical Hacker for NetPerfect Inc. The company operates a Linux-based network, and all client computers run Red Hat 7.0 Linux.

The company’s Sales Manager tells John that his system contains an unknown package called tar.gz and that his documents have been exploited. To resolve the issue, John uses a port scanner to check the open ports and determines that the HTTP server service port, 27374, is open. He suspects that other computers on the network are experiencing the same issue. John finds that a malicious application is using the synscan tool to generate IP addresses randomly.

Which of the following worms has infected the computer?

  • A Code red
  • B Ramen
  • C LoveLetter
  • D Nimda
Explanation

The Ramen worm targeted Red Hat Linux 7.0, used a service listening on TCP port 27374 to propagate its compressed payload, and employed the synscan tool to scan randomly generated IP addresses for additional vulnerable hosts.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!