Subject: unix worm via ssh1
To: None <tech-security@netbsd.org>
From: Hubert Feyrer <hubert.feyrer@informatik.fh-regensburg.de>
List: tech-security
Date: 11/16/2001 15:02:50
Of course geared for Linux, but maybe of general interrest:
http://www.vnunet.com/News/1126812
`` He explained that he had discovered a
compromised Red Hat box that was being used as a
central host for other 'zombie' machines, although
it is not yet clear how the central server
communicates with the zombies.
Apparently the attacker manually installed an IRC
server, which was communicating with more than
120 other host machines.
The communication channel was called 'kujikiri', a
method of esoteric teaching used by the ninja, and
the channel key was tagged 'ninehandscutting', an
ancient ninjitsu hand movement.
Apparently all hosts communicating with the
central server were logging on using identification
names prefixed with 'ninja'.
According to experts, the Trojan program installed
in the attack does not match any signatures
identified so far and, if it is new, Salusky has
already christened it 'Limpninja'. ''
- Hubert
--
Want to get a clue on IPv6 but don't know where to start? Try this:
* Basics -> http://www.onlamp.com/pub/a/onlamp/2001/05/24/ipv6_tutorial.html
* Setup -> http://www.onlamp.com/pub/a/onlamp/2001/06/01/ipv6_tutorial.html
Of course with your #1 IPv6 ready operating system -> http://www.NetBSD.org/