main

main@lists.alug.org.uk

1 participants
10372 discussions

RE:New Linux Varus
by Earl Brannigan 01 Mar '01

01 Mar '01

Hi all What I know about this : Technically Ramen is a worm (not necessarily a virus as such except in the sense that it is self replicating) It uses standard buffer overflow routines ( code freely available from : www.attrition.org, www.securityfocus.com, www.insecure.org) to attack known weaknesses. So effectively it is merely an amalgamation and automation of existing hacking code, with a little port scanning & network detection (OS Fingerprinting by TCP/IP is pretty simple, and very accurate) thrown in for good measure. I understand it also attacks BIND (port 53) which is often the first line of attack anyway. There will be a script available soon to automate removal of RAMEN ( http://www.securityfocus.com/tools/1944) which is worth getting JIC. Previous advice about getting the latest fixes is still the best. (There are a number of ways of automating this but the first thing I recommend to anyone is to subscribe to bugtraq at securityfocus, and also LINUX Security Newsletter - same place). HTH Regards Earl

1 0

Your reply
by Kerin 01 Mar '01

01 Mar '01

Hello Thank you for your reply, but as I keep trying to say is, as a "newbie" I and other do not know about kernel traffic. We have spent a lot of time trying to set up this, what seems a strange system, remember a lot of us are switching over from "Windows" were much of this is done for you, You may say well this is something you should have looked at before. maybe, maybe not. But until someone like your self mentions it, we don't know of it. and all the books I have read have not mentioned it. I sent the article in for two reasons, 1) I,m always being told this can not happen. 2) more importantly, if someone out there is running 6.2 or 7.0 and they have not updated, is not it a friendly thing to do and warn them that they could have a problem. remember the spirit of the Linux world. Please no offense meant. Cheers. Kerin.

2 1

irc
by Neill Newman 28 Feb '01

28 Feb '01

is there an IRC channel where alug people hide ?? Sz -- Open source solutions at http://www.entora.co.uk/

2 1

RE: [Alug] New Linux Varus
by Corner Paul 28 Feb '01

28 Feb '01

Thanks for the snippit of info - I'd been searching the net for some hard information on how this virus attacks linux systems, Now I have some idea of how the thing operates, I can check my system and try to determine if I have a problem. Regards, Paul. > -----Original Message----- > From: Kerin [SMTP:kerin.westgate@virgin.net] > Sent: 28 February 2001 13:46 > To: alug(a)stu.uea.ac.uk > Subject: [Alug] New Linux Varus > > Hi > I,m not realy sure who to send this too, > > I,ve just picked up the new issue of the "new Linux Magazine". and theres > an > article in there worth reading, as follows, > > Page 7 VARUS WARNING > > A new Internet worm that targets computers running Red Hat Linux is be > described by some virus experts as the first successful attack on the > Linux > O/S, which is widely considered to be one of the best protected platforms > around. >

1 0

New Linux Varus
by Kerin 28 Feb '01

28 Feb '01

Hi I,m not realy sure who to send this too, I,ve just picked up the new issue of the "new Linux Magazine". and theres an article in there worth reading, as follows, Page 7 VARUS WARNING A new Internet worm that targets computers running Red Hat Linux is be described by some virus experts as the first successful attack on the Linux O/S, which is widely considered to be one of the best protected platforms around. To penetrate computers that have Red Hat Linux 6.2 or 7.0 installed, The Ramen worm exploits 3 security breeches loopholes - in.ftpd, rc.statd and PLRng. These were identified and closed by developers last summer. The breaches are from the buffer overflow category and could enable hackers to send an executable code to the remote system and run it without the user's authorisation. The Ramen worm infects a system by sending data to a target computer receives data which then overflows the system's internal buffer. This enables the worm code to gain root privileges. It then initialises the command processor that executes the worm's instructions. Next the worm creates the /usr/srcl.poop folder and launches the "lynx" internet browser. There it downloads theworm's archive RAMEN.TGZ from a remote system. After this, Ramen opens the archive and executes its main file START.SH. The worm changes the contents of INDEX.HTML files found on the system, so that when affected HTML files are run they display the following message. RameN Crew Hackers looooooOOOOOOOOOOOve noodles. There is no additional payload. But i have run out of time to finnish the article. Cheers Kerin

2 1

Re: [Alug] [Alasdair Kergon <agk@ukuug.org>] [lugmaster] Internet Fiesta 2nd to 4th March 2001
by MJ Ray 27 Feb '01

27 Feb '01

Apologies for that unwarranted MIMEing. I'll learn how to use my mail client properly one day soon. It also seems my filters don't catch all attachments yet, so I'll sharpen them. -- MJR

1 0

Re: [Alug] I hope this isn't inappropriate...
by MJ Ray 27 Feb '01

27 Feb '01

Adam Bower <abower(a)zeus.com> writes: > How about we only allow posts about jobs from active members of the > list? or to be forwarded by list subscribers for friends, friendly > companys etc. and maybe we need a similar policy for adverts?? You might like that, but I can see the reason why. No, if someone crosses the boundaries of normal good behaviour I'll block them, but I don't want to have to moderate this list yet. After all, there are only 120 people on it at the moment. If we get many more of these, then I'll consider changing policy if people want to. Thoughts? Anyway, back to the Linux with some helpful advice from http://www.chiark.greenend.org.uk/~sgtatham/bugs.html -- MJR

2 1

[Alasdair Kergon <agk@ukuug.org>] [lugmaster] Internet Fiesta 2nd to 4th March 2001
by MJ Ray 27 Feb '01

27 Feb '01

Time for some ALUG networked event? Date: Tue, 27 Feb 2001 13:47:09 +0000 From: Alasdair Kergon <agk(a)ukuug.org> Subject: [lugmaster] Internet Fiesta 2nd to 4th March 2001 I hadn't heard of this until I read this email this morning. Alasdair ----- Forwarded message from Christian de Larrinaga <cdel(a)firsthand.net> ----- Date: Mon, 26 Feb 2001 22:22:28 -0000 From: "Christian de Larrinaga" <cdel(a)firsthand.net> Subject: Invitation to participate in the Internet Fiesta 2nd to 4th March 2001 Your invitation to take part in the worldwide Internet Fiesta 2001. Don't forget to register so people know your taking part. best regards, Christian Christian de Larrinaga Internet Fiesta UK 2001 2nd 4th March 2001 www.internet-fiesta.org +44-(0)1380-816877 Internet Society of England Please forward widely and as appropriate ---------------------------------------------------------- Internet Fiesta- is the world's greatest Internet event and it is coming early this year on the weekend 2nd to 4th March Fiesta weekend is a celebration of the power of the Internet and it is your opportunity to communicate across the world by creating and registering your own special part of this festival of the Internet, participating in thousands of activities with millions of Internet users around the world, in a weekend of fun, culture, interactivity and experiential learning that gets the world buzzing by Internet. Fiesta is an ideal way to find and promote what is happening on the Internet today. What you can do is limited only by the imagination. Nothing is too small to register. Often the simplest ideas have the greatest impact on the Internet .. Try it. So whilst you take a virtual weekend in Paris, you can be greeting new friends in Japan. The Internet Fiesta 2001 is just for a weekend of the 2nd to 4th March 2001. Anybody can participate. Dream up an idea, plan what you will do to make it happen and register it at http://www.internet-fiesta.org/Faq.htm and then get on the net for the weekend.. If you are already holding an event, a concert or a cultural or scientific festival or a course teaching skills or want to demonstrate something new, make sure you connect up and share it with the whole world. Remember the Fiesta is the ideal opportunity to bring people to your project and community and for you to extend what you do to a worldwide community over a single weekend of Internet activities. So learn, teach, watch, film, show, demonstrate, play, talk, webcast, chat, invent, discuss, build, and above all have fun and take possession. The Internet is yours. Fiesta is a weekend of fun, but with a serious intent of getting people to enjoy and use the Internet as a resource for everyone and discover what's new and interesting.. Make sure you take part - register your event. PLEASE NOTE I am also looking for helpers and local co co-ordinators to assist with events and help event organisers. Please register by email to me cdel(a)firsthand.net best regards Christian de Larrinaga Internet Fiesta UK 2001 2nd 4th March 2001 www.internet-fiesta.org +44-(0)1380-816877 cdel(a)firsthand.net Chairman Internet Society of England www.england.isoc.org some background information from Raymond Pougheon of Atelier in Paris a creator of "Fete d'Internet" - The Internet Fiesta. INTERNET FIESTA 2001 Internet Fiesta ? The Internet Fiesta originated in France. Founded on the model of the " music fest ", the first " Internet Fest " was organised in France in 1998. In 1999, with the help of the European Commission, the Fiesta spread out over the world.. In 2000, for it's second edition, the Internet Fiesta organised itself around 65 committees in more than 50 countries over the five continents. A very large amount of events all over the world were organised : Africa, Eastern and Western Europe, South America, but also Canada Corea I order to facilitate the national organisors' work a cordination team of about 50 volunteers edited information in 15 different languages, pages and ressouces on numerous formats such as 3D, linux, flash, Java, webcamsand a database for the events in 10 languages was also accessible for wap phones. Different prize games where organised such as a quiz, a 3D drawing contest or the " fabrique des possibles " wich enabled anybody to conceive new usages tools or scenarios for the Future Internet. Fiesta Plaz was the place where the coordination team physically met 24 hours a day during the event. Everybody, presenting himself as a Fiestoon, the Internet Fiesta mascot, and speaking in one of the 15 languages, participated to the online events all over the world and in very different time zones. Objectifs ? The Internet Fiesta's tries to promote the utilisation of Internet in order to facilitate communication between people. The Internet is boarderless, participants come from the five continents. The goal is to encourage and facilitate daily usage of the Internet and to share experiences and projects with the help of networks be they physical or human. Date ? The Internet Fiesta is a three days international event. This year it will take place from 2nd to 4th of March 2001. Contacts ? There is no centralised organisation but a network of volunteers who : - help to integrate the project and events into the network - organise events and actions in order to promote Internet Fiesta The International website : www.internet-fiesta.org - organizes the registration of the events and initiative - gives out information and tools for the organisors of projects - puts an emphasis an a few initiatives arround the world at the moment when they happen E-mail : info(a)internet-fiesta.org >From march 3th and 4th of march 2001 : Citi des Sciences et de l'Industrie Espace Condorcet (Niveau 0) 30 avenue Corentin-Cariou75019 Paris Mitro : Porte de la Villette How to participate ? Use your imagination and ressources and organise your own event ! Find an idea and sare it with your friends and partners. Once the concept is ready, register it on the Fiesta website :www.internet-fiesta.org Where ever you are Let's fiesta all together >From the 2nd to the 4th of March 2001, the best Information Society ideas will be on focus Where to participate ? On the Internet of course, but also in the villages, in the street, shops or coffes. The services and solutions offered through Internet to the citizens, employees and administrations shall be put forward. Internet Fiesta is the sum of all the events taking place in every country, during the three days. This Fiesta is yours The Ethics The organisation of the Internet Fiesta 2001 is concieved and functions as a human network and because it is a human network. It develops in much the same way as freeware does There for it was possible to demonstrate that you can organize a number of events in an number of languages in the world. After the success of the past two years of Internet Fiesta, we are pursuing this impulse broadenig the event so that you can all participate. ----- End forwarded message ----- -- MJR

1 0

Internet security - cable modems ?
by Andrew Cartwright 26 Feb '01

26 Feb '01

Hi, I would appreciate your help once again, I am using RH 7.0 at the moment and have just configured my NIC (Netgear fa311) to enable my cable modem internet connection. RH 7.1(fisher) configures everything automatically IE NIC,DHCP and firewall. this is all very well but doesn't teach me a great deal about what is going on in the background. I intend to set up RH 7.0 with a firewall and any other security measures that are needed. I would very much appreciate any suggestions/help that anyone can offer to assist me setting up the required services. Things along the lines of :- Which services to disable (and how) Which firewall - ipchains or other package and tips on setting it up TIA

1 0

Re: [Alug] I hope this isn't inappropriate...
by MJ Ray 26 Feb '01

26 Feb '01

I think I'll let both sides howl each other out. ;-) The older hands who remember Laurie's earlier generosity to the group will know he's not the type to say such things for no reason. Those who don't care about IR35 can deal with them if they want to. The list policy on advertising remains "fuzzy" and it's generally a good idea to seek guidance *before* you post. -- MJR

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

main