[Dshield] More stuff from Korea

BioH bioh at biodome.org
Fri May 18 21:23:48 GMT 2001


10008 i believe is a variant of the li0n worm.
it is a suid shell... and you have it if you've fallen victim to the recent
BIND bugs.
'friendly' cheese worm scans for these also, but it in turn tries to turn
off this
vulnerability....

::::::::::::::::::::::...
mike neugebauer
mekka
613.230.7989 tel
613.230.1396 fax
mike at mekkalife.com
193 henderson avenue
ottawa ontario k1n 7p7 canada
www.mekkalife.com


> -----Original Message-----
> From: dshield-admin at dshield.org [mailto:dshield-admin at dshield.org]On
> Behalf Of Tench, Michael
> Sent: Monday, May 14, 2001 10:58 AM
> To: 'dshield at dshield.org'
> Subject: [Dshield] More stuff from Korea
>
>
> As you know, last week a great deal of scans to 111 and 80 were
> originating
> from Asia. As it moved to other networks, it was evident that a
> worm was on
> the loose.
>
> I have noticed scans from many of these Asian networks looking for port
> 10008. Is there a connection?
>
> _______________________________________________
> Dshield mailing list
> Dshield at dshield.org
> To change your subscription options (or unsubscribe), see:
> http://www1.dshield.org/mailman/listinfo/dshield
>




More information about the list mailing list