Ramen Linux worm seen in wild

From...

January 29, 2001
Web posted at: 3:58 p.m. EST (2058 GMT)

by James Evans

(IDG) -- A Linux-based Internet worm known as Ramen -- named after the popular noodle soup -- has been seen in the wild, affecting systems that run Red Hat's 6.2 or 7.0 versions of the open-source OS, several Web security observers report.

The worm has struck a server at the U.S. National Aeronautics and Space Administration (NASA) Jet Propulsion Lab in California, a University of Texas A&M server, and one operated in Taiwan by server vendor Supermicro Computer, according to Attrition.org, a site that chronicles Web site defacements. The worm has been known of since about September 2000 when Red Hat developed a patch addressing it.

IDG.net INFOCENTER InfoWorld Main Page InfoWorld Test Center Subscribe to InfoWorld Newsletters Infoworld Opinions and Spotlights Related IDG.net Stories Melissa comes to the Mac 'Ramen' worm hits some Red Hat Linux servers Users angry at lack of support for Symantec antivirus software Features Top 10 rules for e-business success Bluetooth wireless connectivity set to take off DSL in distress Visit an IDG site Choose a site: IDG.net CIO Computerworld Darwin Dummies.com GamePro.com The Industry Standard ITWorld.com InfoWorld.com JavaWorld LinuxWorld Macworld Online Network World Fusion PC World Publish.com SunWorld IDG.net search

The worm only affects servers running Red Hat's Linux and not any of Microsoft's operating systems, computer security company Symantec said. The worm apparently hits sites that run Red Hat Linux and then spreads itself by locating like servers running the same OS.

Three known security breaches are struck by the Ramen worm, according to Kaspersky Lab International, an international data-security software development company in Cambridge, United Kingdom, in a statement. The breaches allow Ramen to take over root access rights, and unbeknownst to the user, execute its code on target file systems.

The Computer Emergency Response Team (CERT) Coordination Center at Carnegie Mellon University, in Pittsburgh, which put out an advisory about the Ramen worm on Jan. 18, warns that the worm could damage or alter Web-related files and system files. It also might create denial-of-service (DoS) conditions when altered or when destroyed files are not available. Ramen worm victims are at high risk for "being party to attacks on other Internet sites," according to CERT's advisory.

If the worm does hit a system, it modifies the index.html file and defaces the Web site. It ultimately replaces the index.html file with the words "RameN Crew" and "Hackers looooooooooooooooove noodles." Then a message appears that says "This site powered by" and a picture of a Top Ramen noodles package is displayed, according to Symantec.

Durham, N.C.-based Red Hat has received some calls recently, directed to its tech-support crew to assist with working through problems from the worm, said Melissa London, a spokeswoman for the company. But there have not been a lot of tech-support requests, she said. If users were on top of the patch notification, they should not be having problems, she said.

'Ramen' worm hits some Red Hat Linux servers
January 19, 2001
Security firm warns of Red Hat Piranha 'back door'
April 27, 2000
IT pros debate security of Linux and Unix
June 8, 2000
Linux users unscathed by ILOVEYOU
May 9, 2000
Wireless Net, Linux, Win2000 to take center stage
February 16, 2000
Network Associates unleashes VIPER
December 22, 1999

Melissa comes to the Mac
(Macworld)
'Ramen' worm hits some Red Hat Linux servers
(Computerworld)
Users angry at lack of support for Symantec antivirus software
(Computerworld)
What you didn't get for Christmas: viruses
(InfoWorld.com)
When love came to town: A virus investigation
(PCWorld.com)
The latest tidbits on security news
(SunWorld)
Was there a global youth plot to cripple the Web?
(The Industry Standard)
Shockwave virus appears to do little damage
(Computerworld)

CERT Coordination Center
NASA

Note: Pages will open in a new browser window

External sites are not endorsed by CNN Interactive.