Draft:Lion worm
Submission declined on 7 April 2026 by Pythoncoder (talk).
Where to get help
How to improve a draft
You can also browse Wikipedia:Featured articles and Wikipedia:Good articles to find examples of Wikipedia's best writing on topics similar to your proposed article. Improving your odds of a speedy review To improve your odds of a faster review, tag your draft with relevant WikiProject tags using the button below. This will let reviewers know a new draft has been submitted in their area of interest. For instance, if you wrote about a female astronomer, you would want to add the Biography, Astronomy, and Women scientists tags. Editor resources
|  |
| Lion worm | |
|---|---|
| Original author | Unknown |
| Release | March 2001 |
| Written in | Bash, C |
| Operating system | Linux |
| Platform | x86 |
| Type | Computer worm, Malware |
Lion (also known as 1i0n) is a computer worm that spread over the Internet in early 2001, first reported by the SANS Institute on March 23, 2001.[1] It targeted Linux machines running vulnerable versions of the BIND DNS software.[2]
While the vulnerabilities in BIND affected multiple Unix-based operating systems,[3] the worm code targeted Linux specifically, and more precisely Linux running on x86 processor architecture. A detection tool called lionfind, was written by William Stearns of the Dartmouth College Institute for Security Technology Studies, who also co-authored the original SANS advisory.[4]
Media coverage
[edit]At the time of its spread, Lion received coverage in mainstream technology outlets. ITWorld and CNN both published reports on March 23, 2001, with the CNN article citing IDG as its source.[5][6]
Technical analysis
[edit]A technical analysis was published by security researcher Max Butler (known online as Max Vision). He identified three versions of the worm. He also identified similarities with previous worms. Specifically with the ADM worm (1998), the Millennium worm (1999), and the Ramen worm (2001). Butler also reported having interviewed a individual claiming to be the author, though this attribution has not been independently verified.[7]
A separate technical analysis mentions that Lion downloads a part from a web server located in China and that the worm sends password files to the china.com domain.[8]
See also
[edit]References
[edit]- ↑ "ALERT – A Dangerous New Worm Is Spreading on the Internet". LWN.net. 2001-03-23. Retrieved 2026-03-29.
{{cite web}}: CS1 maint: url-status (link) - ↑ Fearnow, Matt; Stearns, William. "Lion Worm". SANS Institute. Archived from the original on 2001-06-04. Retrieved 2026-03-29.
- ↑ "CA-2001-02: Multiple Vulnerabilities in BIND" (PDF). CERT Coordination Center. 2001-01-29. Retrieved 2026-03-29.
- ↑ "Lion Worm Detection Tool". Institute for Security Technology Studies, Dartmouth College. Archived from the original on 2004-06-07. Retrieved 2026-03-29.
- ↑ "New Linux Worm Spreading Rapidly". ITWorld. 2001-03-23. Archived from the original on 2003-12-31. Retrieved 2026-03-29.
- ↑ "Linux Worm Spreading Fast". CNN.com. 2001-03-23. Archived from the original on 2007-01-02. Retrieved 2026-03-29.
- ↑ Butler, Max (2001). "Lion Internet Worm Analysis". whitehats.com. Archived from the original on 2001-04-14. Retrieved 2026-03-29.
- ↑ Rautiainen, Sami (March 2021). "Lion". F-Secure.com. Archived from the original on 2001-04-14. Retrieved 2026-04-01.
LLM-generated pages with certain obvious signs of being machine generated may be deleted without notice.
Instead, only summarize in your own words a range of independent, reliable, published sources that discuss the subject.
See the advice page on large language models for more information.