The MSS Outside Advisory Redistribution is designed to provide customers of IBM Managed Security Services with access to the security advisories sent out by other computer security incident response teams, vendors, and other groups concerned about security. IBM makes no representations and assumes no responsibility for the contents or accuracy of the advisories themselves. Contact information for NIPC is included in the forwarded text below. Please contact them if you have any questions or need further information.
Forwarded Information Starts Here.
Illegal activity of this nature typically is designed to create large networks of hosts capable of launching coordinated packet flooding denial of service attacks. Possible motives for this malicious activity include exploit demonstration, exploration and reconnaissance, or preparation for widespread denial of service attacks. Once infected, the Lion worm scans random class B networks on port 53 looking for systems running the vulnerable bind versions listed above. In addition to the above listed toolkit, the Lion worm installs several backdoor compromises along with what NIPC analysis confirms is a password sniffer, thereby giving the hacker a network of machines from which to launch an attack in the future. This initial activity appears to be the precursor to a larger DDOS attack.