Re: LINUX VIRUS ALERT: A DANGEROUS NEW WORM IS SPREADING ON THE INTERNET (fwd)

From: Dave Sill (extropians@dave.sill.org)
Date: Fri Mar 23 2001 - 17:15:57 MST


"Robert J. Bradbury" <bradbury@aeiveos.com> wrote:
> Those of you who are running LINUX should read this. Those not,
> just toss it.

Those of you running BIND should toss it. BIND, that is. Try djndns instead.

> The Lion worm spreads via an application called "randb". Randb scans
> random class B networks probing TCP port 53. Once it hits a system, it
> checks to see if it is vulnerable. If so, Lion exploits the system using
> an exploit called "name". It then installs the t0rn rootkit.

I think this is just more SANS alarmism. I've received no fewer than 10
copies of this warning today, but I've seen zero reports of the virus. SANS
seems to really play up every security threat they can, perhaps to sell
their conferences.

Hey, maybe we should warning people about being prepared for the
Singularity. DIRE CONSEQUENCES AWAIT THOSE NOT PREPARED FOR THE SINGULARITY!

-Dave



This archive was generated by hypermail 2b30 : Mon May 28 2001 - 09:59:42 MDT