“The recently discovered Lion worm, which attacks Linux BIND
(DNS) servers, is turning out to be one nasty little package which
leaves infected victims with no choice but to re-format their
entire systems and rebuild from scratch.“
“We recently received a copy of a version which was released
late last week, thanks to a Register reader who prefers to remain
anonymous. On examining the package, we were immediately struck by
how sophisticated and functional it is, and yet how kiddie-friendly
it is as well. It obviously took considerable ingenuity and
forethought to create, yet requires almost none to deploy (a bit
like SubSeven in that regard).”
“It’s also exceptionally destructive, as we confirmed from
examining the logs of one victim who ran the Lionfind detection
utility on his infected system after having cleaned up manually as
well as he could. The number of files and directories Lion infects
is nothing short of staggering.”