Signature Detail
Short Name |
TROJAN:BACKORIFICE:WEB-SERVER |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
TROJAN |
Keywords |
TROJAN |
Release Date |
2003/04/22 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
TROJAN: BackOrifice Web Server Response
This signature detects the format string "BO" within an outgoing HTTP response sent from local port 80. This can indicate that an attacker is using the Trojan Back Orifice to remotely control the system.
Extended Description
BackOrifice is a remote adminstration tool. It enables remote attackers to gain control over an infected machine.
References