They have a robot checking all IP addresses for an active port 25 and then the robot tries the
exploit. They really do not care how many times it fails, they simply want to find the servers
where it does not fail. The actual exploit as provided was not all that big a deal, it only
crashed the program. The ones you worry about are the ones that use the vulnerability to
actually access and run code on the host.
These hackers really like these vulnerability reporting forums that do not pass the exploit on to
the developer when reporting it to the subscribers of it's reports (actually the developer should
get this before it's reported to the entire world). It's just like getting a zero day virus since the
guy that can fix it has never been notified by anyone until the users happen to notice this and
report it.
Meanwhile I've got a third attempt. From the logs I must assume that
they are acting in a surprisingly clever way:
They first verify the server's reaction by attempting a plain vanilla
AUTH CRAM-MD5
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.....
with ~1k of these "aaaaaa"
As SBK alraedy filters that out, I can't tell what would coming next.
But there's to expect they either record the result with the IP of the
vulnerable system and would attack at a later time, or they will make
immediately follow a subsequent attack with the real payload to be put
on the stack. For the latter I've no time/eagerness as to know how they
actually would infect/takeover the system.
But it's most evident that we have to expect a huge number of Mercury
systems being transformed into zombies over the next days and weeks, as
this vulnerability is definitely actively exploited RIGHT NOW!
