Draft:Lion worm
Submission declined on 7 April 2026 by Pythoncoder (talk).
Where to get help
How to improve a draft
You can also browse Wikipedia:Featured articles and Wikipedia:Good articles to find examples of Wikipedia's best writing on topics similar to your proposed article. Improving your odds of a speedy review To improve your odds of a faster review, tag your draft with relevant WikiProject tags using the button below. This will let reviewers know a new draft has been submitted in their area of interest. For instance, if you wrote about a female astronomer, you would want to add the Biography, Astronomy, and Women scientists tags. Editor resources
|  |
| Lion worm | |
|---|---|
| Original author | Unknown |
| Release | March 2001 |
| Written in | Bash, C |
| Operating system | Linux |
| Platform | x86 |
| Type | Computer worm, Malware |
Lion (also known as 1i0n) is a computer worm that spread over the Internet in early 2001, first reported by the SANS Institute on March 23, 2001.[1] It targeted Linux machines running vulnerable versions of the BIND DNS software.[2]
While the vulnerabilities in BIND affected multiple Unix-based operating systems,[3] the worm code targeted Linux specifically, and more precisely Linux running on x86 processor architecture. A detection tool called lionfind, was written by William Stearns of the Dartmouth College Institute for Security Technology Studies, who also co-authored the original SANS advisory.[4]
Media coverage
[edit]At the time of its spread, Lion received coverage in mainstream technology outlets. ITWorld and CNN both published reports on March 23, 2001, with the CNN article citing IDG as its source.[5][6]
Technical analysis
[edit]A technical analysis was published by security researcher Max Butler (known online as Max Vision). He identified three versions of the worm. He also identified similarities with previous worms. Specifically with the ADM worm (1998), the Millennium worm (1999), and the Ramen worm (2001). Butler also reported having interviewed a individual claiming to be the author, though this attribution has not been independently verified.[7]
A separate technical analysis mentions that Lion downloads a part from a web server located in China and that the worm sends password files to the china.com domain.[8]
See also
[edit]References
[edit]- ↑ "ALERT – A Dangerous New Worm Is Spreading on the Internet". LWN.net. 2001-03-23. Retrieved 2026-03-29.
{{cite web}}: CS1 maint: url-status (link) - ↑ Fearnow, Matt; Stearns, William. "Lion Worm". SANS Institute. Archived from the original on 2001-06-04. Retrieved 2026-03-29.
- ↑ "CA-2001-02: Multiple Vulnerabilities in BIND" (PDF). CERT Coordination Center. 2001-01-29. Retrieved 2026-03-29.
- ↑ "Lion Worm Detection Tool". Institute for Security Technology Studies, Dartmouth College. Archived from the original on 2004-06-07. Retrieved 2026-03-29.
- ↑ "New Linux Worm Spreading Rapidly". ITWorld. 2001-03-23. Archived from the original on 2003-12-31. Retrieved 2026-03-29.
- ↑ "Linux Worm Spreading Fast". CNN.com. 2001-03-23. Archived from the original on 2007-01-02. Retrieved 2026-03-29.
- ↑ Butler, Max (2001). "Lion Internet Worm Analysis". whitehats.com. Archived from the original on 2001-04-14. Retrieved 2026-03-29.
- ↑ Rautiainen, Sami (March 2021). "Lion". F-Secure.com. Archived from the original on 2001-04-14. Retrieved 2026-04-01.
Please delete the portions which were LLM-generated, and summarize in your own words a range of independent, reliable, published sources that discuss the subject. If you have used an LLM but you believe that your use is covered by one of the two exceptions (basic copyediting and translation between two languages in which you are fully fluent), please provide a transcript of the prompt(s) you used while writing your draft (see the how-to guide). Reviewers can make mistakes. If you have not received any LLM assistance, you may seek a second opinion at the AfC Help Desk.
See the advice page on large language models for more information.