LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 03-23-2001, 01:45 PM   #1
tfrye
Member
 
Registered: Dec 2000
Posts: 60

Rep: Reputation: 15
Angry


There is a new workm virus out there that can do some damage to a Linux system. apparently, it scans your tcp ports, and when it finds one that is vulnerable, it exploits it and uses your computer to infect others. It sends a copy of your passwrd files and some other netowrk related data to a China.com address.

Does anyone know if there is a fix?
 
Old 04-03-2001, 09:52 AM   #2
raz
Member
 
Registered: Apr 2001
Location: London
Posts: 408

Rep: Reputation: 31
Cool

I know this is an Old message, but as I know the answer I thought I would reply.

The worm is called the Lion Worm it's a new worm that is very similar to the Ramen worm.
This worm is much more dangerous and should be taken seriously. It infects Linux machines with the BIND DNS server running. "i.e. port 53"
It is known to infect BIND version(s) 8.2, 8.2-P1, 8.2.1, 8.2.2-Px.

The worm scans random class B address for port 53 and tests each system it finds.
Once it has found a BIND exploitable system it is able to get "root" access and adds a rootkit called t0rn.

It's payload is to scan for more class b exploitable systems.It also emails your passwd and shadow file + ip setting to an email address in the china.com domain.

It also opens 2 backdoor on port numbers 60008/tcp and 33567/tcp and a trojaned version of ssh gets placed on 33568/tcp
Syslogd is turned off so no logging takes place.
It replaces about 40 system exec files like ls, netstat etc etc etc with trojan files.

If you don't have a DNS server running then you don't have the worm Trojan.

If you do have an old version of DNS then check this.
"can't trust netstat -a or ls command"
cat /dev/.lib/lib/lib/ls
if it says
cat: /dev/.lib/lib/lib/ls: No such file or directory
your ok, if displays a binary file in garbage, then you can't trust your system and should blow it away and install the latest version of Bind.

/Raz
To answer your question yes the fix is Bind 9.x.
Note: there is a new worm that scans for more then just bind. check out http://www.sans.org/current.htm
 
Old 04-03-2001, 02:38 PM   #3
drjimstuckinwin
Member
 
Registered: Mar 2001
Location: Manchester UK
Distribution: Mainly Fedora
Posts: 496

Rep: Reputation: 30
Angry Worms

Hi

Interestingly my Win98 box got HLLW.bymered yesterday, it appeared when the RH7 box was online, and the Win98 box not (as I haven't quite got this IP masquerade sorted yet), though they were networked.

The symantec website and my Ghost image file (stored in 2 separate places as I REALLY don't trust microsoft security/stability) saved the day.

I thought this worm only attacked through Windows, or can it see through Linux??

Any ideas???

Jim
 
Old 04-03-2001, 02:40 PM   #4
drjimstuckinwin
Member
 
Registered: Mar 2001
Location: Manchester UK
Distribution: Mainly Fedora
Posts: 496

Rep: Reputation: 30
WORM 2

Just got hllw.bymer again. Maybe it's my ISP. Online via Win98 box now, maybe I was doing that before.
Either that or Jeremys server is totally anti Windoze!!
 
Old 04-04-2001, 08:16 AM   #5
jeremy
root
 
Registered: Jun 2000
Distribution: Debian, Red Hat, Slackware, Fedora, Ubuntu
Posts: 13,002

Rep: Reputation: 3730Reputation: 3730Reputation: 3730Reputation: 3730Reputation: 3730Reputation: 3730Reputation: 3730Reputation: 3730Reputation: 3730Reputation: 3730Reputation: 3730
Exclamation

I can assure you that it's not me.
 
Old 04-04-2001, 08:41 AM   #6
drjimstuckinwin
Member
 
Registered: Mar 2001
Location: Manchester UK
Distribution: Mainly Fedora
Posts: 496

Rep: Reputation: 30
Thought not, but you can never be certain of these things!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Lupper Worm Capt_Caveman Linux - Security 13 02-27-2006 11:07 AM
Worm on Linux? :O Cdzin Linux - Security 7 03-10-2004 04:51 PM
How do you get a virus or worm? BajaNick Linux - Security 12 08-13-2003 09:57 AM
i got Worm cinik thep Linux - Security 5 10-31-2002 08:14 PM
Slaper worm FredrikN Linux - Security 5 09-17-2002 03:44 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 12:35 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration