In addition to the above listed toolkit, the Lion worm installs several backdoor compromises along with what NIPC analysis confirms is a password sniffer, thereby giving the hacker a network of machines from which to launch an attack in the future. This initial activity appears to be the precursor to a larger DDOS attack. These backdoor compromises provide root access to the victim systems, thereby making security more difficult. Systems administrators who detect such a compromise should take all appropriate steps to reestablish the integrity of their computers and networks. NIPC recommends that all computer network owners and organizations examine their systems for evidence of this worm and associated DDOS tools.
Users running affected versions of bind can go to and download the most recent patch.
It has been designed to detect tfn2k client, tfn2k daemon, trinoo daemon, trinoo master, tfn daemon, tfn client, stacheldraht master, stacheldraht client, stachelddraht demon and tfn-rush client. Consult the readme file for more information. This download is for Solaris 2.5.1, 2.6, and Solaris 7 on the Sparc or Intel platforms, and Linux on Intel platforms. Further, the tfn2k daemon is launched once it is installed and also upon reboot. This creates a widespread zombie network that is ready to receive commands and launch an attack.