<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 5.50.4611.1300" name=GENERATOR></HEAD>
<BODY style="MARGIN-TOP: 2px; FONT: 10pt Arial; MARGIN-LEFT: 2px">
<DIV>Thought I would pass this along.</DIV>
<DIV> </DIV>
<DIV>The latest buzz in the computing world is the dreaded and dangerous new
<BR>worm called the Lion. Similar to the Ramen worm, the Lion worm scans <BR>the
Internet looking for Linux computers with BIND vulnerabilities -- <BR>more than
20% of servers on the Internet. The Lion worm infects the <BR>vulnerable
machines, steals the password file and sends it to a site in <BR>China, installs
a few more goodies, scans the Internet looking for <BR>other victims, and then
tries to replicate itself. Unfortunately, this <BR>worm is far more
dangerous than Ramen and should be taken very <BR>seriously.<BR><BR>Lion infects
Linux machines running BIND versions 8.2, 8.2-P1, 8.2.1, <BR>8.2.2-Px, and all
8.2.3-betas through the TSIG vulnerability we all <BR>know and love. The Lion
worm spreads via an application called "randb", <BR>which scans random class B
networks probing TCP port 53. Once it hits a <BR>system, Lion checks for
vulnerabilities. Once found, Lion exploits the <BR>system using an exploit
called "name" and then installs the t0rn <BR>rootkit.<BR><BR>Here is a fairly
complete list of what is affected (according the SANS
<BR>Institute):<BR><BR> * Sends the contents of /etc/passwd,
/etc/shadow, and some network <BR> settings to an
address in the china.com domain;<BR> * Deletes
/etc/hosts.deny, eliminating the host-based perimeter
<BR> protection afforded by tcp
wrappers;<BR> * Installs backdoor root shells on ports
60008/tcp and 33567/tcp <BR> (via inetd, see
/etc/inetd.conf);<BR> * Installs a Trojan version of ssh that
listens on 33568/tcp; <BR> * Kills Syslogd, so the logging on
the system can't be trusted;<BR> * Installs a Trojan version
of login;<BR> * Looks for a hashed password in
/etc/ttyhash;<BR> * /usr/sbin/nscd is overwritten with a
Trojan version of ssh;<BR> * The t0rn rootkit replaces several
system binaries in order to
<BR> stealth itself including: du, find, ifconfig,
in.telnetd, <BR> in.fingerd, login, ls, mjy,
netstat, ps, pstree and top;<BR> * "Mjy", a utility for
cleaning out log entries, is placed in /bin <BR>
and /usr/man/man1/man1/lib/.lib/;<BR> * in.telnetd is also
placed in these directories, but its use is <BR>
not known at this time;<BR> * A setuid shell is placed in
/usr/man/man1/man1/lib/.lib/.x.<BR><BR>Thankfully, SANS has developed a utility
called Lionfind that will <BR>detect the infected system. This utility lists
files on the system are <BR>suspect; however, it is not able to remove the virus
at this time. <BR>Download Lionfind at: <A
href="http://www.sans.org/y2k/lionfind-0.1.tar.gz">http://www.sans.org/y2k/lionfind-0.1.tar.gz</A><BR></DIV>
<DIV> </DIV>
<DIV>Jon L. Miller, MCNE ASE<BR>Director/Sr Systems Consultant<BR>MMT Networks
Pty Ltd<BR><A
href="http://www.mmtnetworks.com.au">http://www.mmtnetworks.com.au</A><BR>PH:
+61 8 9242 8600<BR>FX: +61 8 9242 8611</DIV></BODY></HTML>