Adore, a new Linux worm is on the loose ------------------------------------------------------------------------ SUMMARY Yesterday, the SANS Institute (through its Global Incident Analysis Center) uncovered a new worm variant (Adore) of 2 existing Linux worms (Ramen and Lion). DETAILS Adore is a worm that the SANS institute originally called the Red Worm. It is similar to the Ramen and Lion worms. Adore scans the Internet checking Linux hosts to determine whether they are vulnerable to any of the following well-known exploits: LPRng, rpc-statd, wu-ftpd and BIND. LPRng is installed by default on Red Hat 7.0 systems. From the reports so far, Adore appears to have started its spread on April 1. Adore worm replaces only one system binary (ps), with a trojaned version and moves the original to /usr/bin/adore. It installs the files in /usr/lib/lib. It then sends an email to the following addresses: [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], and [EMAIL PROTECTED] Attempts have been made to get these addresses taken offline, but no response so far from the provider. It attempts to send the following information: · /etc/ftpusers · ifconfig · ps -aux (using the original binary in /usr/bin/adore) · /root/.bash_history · /etc/hosts · /etc/shadow Adore then runs a package called "icmp". With the options provided with the tarball, it by default sets the port to listen too, and the packet length to watch for. When it sees this information it then sets a rootshell to allow connections. It also sets up a cronjob in cron daily (which runs at 04:02 am local time) to run and remove all traces of its existence and then reboots your system. However, it does not remove the backdoor. Detection: SANS has developed a utility called adorefind that will detect the adore files on an infected system. adorefind <http://www.sans.org/y2k/adorefind-0.2.0.tar.gz> http://www.sans.org/y2k/adorefind-0.2.0.tar.gz Removal: As adorefind runs, it will give you the option to stop the running worm jobs and remove the files from the filesystem. ADDITIONAL INFORMATION Further information can be found at: <http://www.sans.org/y2k/adore.htm> http://www.sans.org/y2k/adore.htm <http://www.sans.org/current.htm> http://www.sans.org/current.htm <http://www.sans.org/y2k/ramen.htm> http://www.sans.org/y2k/ramen.htm <http://www.sans.org/y2k/DDoS.htm> http://www.sans.org/y2k/DDoS.htm The information has been provided by <mailto:[EMAIL PROTECTED]> Matt Fearnow of the SANS GIAC Incident Handler. -- Eko Sulistiono (ICQ #108362506) MIKRODATA Magazine Web: http://www.mikrodata.co.id/ WAP: http://www.mikrodata.co.id/wap/index.wml ------------------------- Suarakan Pendapat Anda Tentang: Kenaikan Tarif Pulsa Telepon 40% Fax 62 21 5715527, 5720696 (Komisi IV DPR RI) PPnBM Fax 62 21 575-6031 (Komisi IX DPR RI). * Gunadarma Mailing List ----------------------------------------------- * Archives : http://milis-archives.gunadarma.ac.id * Langganan : Kirim Email kosong ke [EMAIL PROTECTED] * Berhenti : Kirim Email kosong ke [EMAIL PROTECTED] * Administrator: [EMAIL PROTECTED]
