In the span of one year, we received at our home systems more than 3,000 Trojan horse-related port scans. The sources of these scans were almost always dial-up accounts, which provide the cover that attackers need to obfuscate their origins. Dial-up accounts can be easily forged with a stolen credit card and a bogus mailing address, making them ripe for abuse. And the aggravation one must endure to stop an attacker can be overwhelming. Administrators often ignore the risk rather than go through the hassle of working with a large ISP to chase down the numerous dial-up attackers.
Subseven installations appear to have reached epic proportions on the Internet.
The Subseven 2.1 server Trojan horse was released on Sept. 15 and contains just about everything a mad hacker's heart desires. The program is in essence a remote-control program that allows a remote attacker to use the Subseven client to connect to the server and run just about any command. Among the most deadly of these features are the port redirector and the port scanner. The Subseven port redirector allows an attacker to target any system by redirecting ports on the affected system to a new target. This is great for malicious hackers who wish to take advantage of the home user's VPN client software, which tunnels into your corporate network and opens up your corporate systems.