Detected Linux LPRng autorooter

From: Arthur Donkers (arthurat_private)
Date: Sun May 20 2001 - 01:02:35 PDT

Next message: Fabio Bastiglia Oliva: "Several probes from"

Previous message: gattacaat_private: "Canned scan...part 2"
Reply: Fabio Bastiglia Oliva: "Several probes from"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hi All,

Today we encountered a LPRng autorooter for Linux. It attacked our honeypot
and we were able to capture it. The program is called alpd and it creates
a basic shell backdoor. It also contains a built in scanner for scanning
new victims.

Arthur

--
/* Disclaimer :   you hire my skills, not my opinions, those are mine !    */
/* email : arthurat_private    Security    'Me ? I'm not me ! I'm just a   */
/* phone : (+31) 50 549 2701   is not a     computer simulation of me'     */
/* URL http://www.reseau.nl   dirty word      Red Dwarf, First Episode     */

Next message: Fabio Bastiglia Oliva: "Several probes from"
Previous message: gattacaat_private: "Canned scan...part 2"
Reply: Fabio Bastiglia Oliva: "Several probes from"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Sun May 20 2001 - 09:40:54 PDT