Detected Linux LPRng autorooter

[Arthur Donkers <arthur () reseau nl>]

Hi All,

Today we encountered a LPRng autorooter for Linux. It attacked our honeypot
and we were able to capture it. The program is called alpd and it creates
a basic shell backdoor. It also contains a built in scanner for scanning
new victims.

Arthur

--
/* Disclaimer :   you hire my skills, not my opinions, those are mine !    */
/* email : arthur () reseau nl    Security    'Me ? I'm not me ! I'm just a   */
/* phone : (+31) 50 549 2701   is not a     computer simulation of me'     */
/* URL http://www.reseau.nl   dirty word      Red Dwarf, First Episode     */