About the Book
Source: Wikia. Pages: 81. Chapters: Adm, Autostart, Badtrans, Beagle, Blackworm, Blaster, Bridex, Bubbleboy, Bymer, Caribe, Chick, Christmas tree, Coconut, CodeRed, Collo, Commwarrior, Conficker, Dasher, Dumaru, ExploreZip, Father Christmas, Fizzer, Frethem, Gibe, Happy99, Hazafi, Homepage, Hybris, Imsolk, Inqtana, Klez, Lara, Lion, Loveletter, Lovgate, Maldal, Mimail, Morris, Mydoom, Mylife, Mytob, Navidad, Netsky, Nimda, OnTheFly, Oompa, Opener, Parrot, Prettypark, Quizy, Ramen, Roron, Sadmind, Santy, Sasser, Sharp, Sircam, Slammer, Sober, Sobig, Spacehero, Spybot, Spyki, Stages, Stration, Stuxnet, Swen, Tanatos, Welchia, Winevar, Witty, Xerparc, Yaha, YahaSux, Zhelatin, Zotob. Excerpt: Adm is the first Linux worm. A system targeted by Adm will receive a specially crafted packet on tcp port 53. The packet exploits a buffer overflow in the BIND DNS server and allows the code to run with root privileges. Adm creates the user account w0rm with no password and a suid shell with root privileges in the /tmp directory named .w0rm on the target machine. It deletes the hosts.deny file in /etc to prevent it from blocking requests from any IP address. The exploit then downloads the file named ADMw0rm.tgz, containing the main body of the worm. When a system is infected, the worm sends an email to the address admsmb@hotmail.com, notifying the person with access to this email address that the system has been successfully infected. It removes the index.html page (the starting page of a website) and replaces it with an index.html page containing the sentence "The ADM Inet w0rm is here ! ." To look for new systems to infect, Adm starts with a random IP address works its way from there, scanning all addresses up to 229.230.230.230. For each address, it checks id port 53 is active and if it supports IQUERY. If so, it sends its exploit code to the target computer at that IP address. The worm was wild at at least one location in March of 1999. It infected a Red Hat Linux box in A...
