Re: Lion Worm/crew.tgz

[Andreas Östling <andreaso () IT SU SE>]

On Fri, 23 Mar 2001, Alfred Huger wrote:

> Neil Long <neil.long () computing-services oxford ac uk> mailed me and
> mentioned that it might be worth pointing out that the SANS GIAC analysis
> is not valid for the crew.tgz version that was sent to Incidents by
> Andreas stling <andreaso () IT SU SE>
>
> There is no t0rn rootkit involved and the root shell is on  1008 so their
> Lionfind may be misleading.
>
> Of course, they could be half a dozen variants on the loose by this stage.

The packet I posted where it opens up the root shell on 1008 is just one
part of the worm. The rest of it is in crew.tgz (the t0rnkit is in there
among other things). So the SANS GIAC analysis is valid for crew.tgz
(the http://coollion.51.net/crew.tgz version).
FYI I just installed this version on an offline machine, and Lionfind found it.

Regards,
Andreas Östling