New worm targets unprotected Linux systems

From...

By Kim S. Nash

(IDG) -- Security analysts warned this week that another worm is hunting the Internet for Linux systems left unprotected against several well-publicized vulnerabilities, including one commonly found in Version 7.0 of Durham, N.C.-based Red Hat Inc.'s Linux release.

Known as "Adore," the new worm appears to have begun propagating last Sunday, according to an advisory issued by the SANS Institute, a Bethesda, Md.-based research organization for systems administrators and security managers. Adore is the third worm found to be targeting Linux servers since January, following earlier ones called "Ramen" and "Lion."

MESSAGE BOARD Security on the Net   IDG.net INFOCENTER Computerworld main page Computerworld's topic-oriented communities Computerworld's IT career center Free daily newsletters Related IDG.net Stories First virus to infect Windows, Linux apps appears Federal systems increasingly falling prey to hackers IE flaw lets hackers take over user's computer Features Cool gifts for cool nerds Mastering e-commerce by degrees Fast-track training puts nontechies in IT jobs Visit an IDG site Choose a site: IDG.net CIO Computerworld Darwin Dummies.com GamePro.com The Industry Standard ITWorld.com InfoWorld.com JavaWorld LinuxWorld Macworld Online Network World Fusion PC World Publish.com SunWorld IDG.net search

The newest worm is similar to Ramen and Lion in the way it acts, SANS said. Adore creates back doors in computers based on the open-source Linux software, then automatically transmits configuration data and other identifying information about the compromised systems to four e-mail addresses.

At risk, SANS said, are Linux systems that haven't been protected against vulnerabilities known as rpc-statd, wu-ftpd, LPRng and the Berkeley Internet Name Domain (BIND) software. LPRng is installed by default on servers running Red Hat 7.0, according to SANS, while BIND refers to a series of holes in the Redwood City, Calif.-based Internet Software Consortium's BIND server software.

All of those vulnerabilities are well-known and can be blocked by readily available patches. But Adore and other worms like it can easily find exposed systems because IT managers frequently don't have time to install every security patch and bug fix that's released, said Eric Hemmendinger, an analyst at Aberdeen Group Inc. in Boston.

"We can stand up and tell people they ought to be keeping up-to-date with patches, but in the real world, that's not particularly useful advice," Hemmendinger said. "There are just so many of them." A better tack for buys users is to install -- and routinely run -- virus-filtering products on Internet gateways, he added.

SANS said William Stearns, a senior research engineer at the federally-funded Institute for Security Technology Studies at Dartmouth College in Hanover, N.H., has written a utility that's supposed to be able to detect the Adore worm's presence on infected systems. The script, called Adorefind, can be downloaded from Dartmouth's Web site.

Stearns, who created a similar utility called Lionfind after the Lion worm was discovered last month, also helped the SANS Institute prepare its advisory about Adore.

Bulletin: 'Dangerous' Linux worm in the wild
March 23, 2001
Ramen Linux worm seen in wild
January 29, 2001
'Ramen' worm hits some Red Hat Linux servers
January 19, 2001
Security firm warns of Red Hat Piranha 'back door'
April 27, 2000
IT pros debate security of Linux and Unix
June 8, 2000
Linux users unscathed by ILOVEYOU
May 9, 2000
Wireless Net, Linux, Win2000 to take center stage
February 16, 2000
Network Associates unleashes VIPER
December 22, 1999

First virus to infect Windows, Linux apps appears
(InfoWorld.com)
Federal systems increasingly falling prey to hackers
(Computerworld)
IE flaw lets hackers take over user's computer
(IDG.net)
Legislature eyes cybersecurity
(Computerworld)
Another hole in MS Exchange security
(IDG.net)
MS updates Windows to combat VeriSign glitch
(ITWorld.com)
Bush adviser urges cybercrime cooperation
(Computerworld)
Microsoft details browser privacy tools
(InfoWorld.com)

SANS Institute

Note: Pages will open in a new browser window

External sites are not endorsed by CNN Interactive.