We think they are modifying the HTML pages in the worm with their own text and graphics. As earlier reported, the Ramen worm is a self-spreading program that has been cobbled together from several such tools and focuses on versions 6.2 and 7.0 of Red Hat's Linux operating system. The flaws exploited by the worm, however, affect other Linux distributions and some Unix systems as well. Depending on the version of the operating system it's infecting, Ramen can use well-known flaws in Washington University's FTP server software, a component of the Remote Procedure Call services or the printing software LPrng. These programs are normally placed on servers during the default installation of Red Hat 6.2 and 7.0.
Patches are available for all the flaws used by the worm.
After the worm finds a vulnerable server, it uses the vulnerability to copy itself to the server, replace the front Web page with its own, and then starts scanning for other insecure servers. Ramen also eliminates the vulnerable programs from the server, thus protecting itself from other instances of the Ramen worm and other vandals using the same vulnerabilities. After the worm was discovered early last week, the Computer Emergency Response Team at Carnegie Mellon University released an advisory describing the workings of the program. For the most part, the worm can be removed easily from servers. It's likely that the increase in activity is due to the worm, said Attrition's Dickerson.