Ramen worm
Encyclopedia
The Ramen worm, also referred to (albeit incorrectly) as the "Ramen virus", was a worm
that spread in January 2001, targeting systems running versions 6.2 and 7.0 of the Red Hat
Linux distribution.
This worm propagated using a brute force technique, searching the Internet for other machines running Red Hat Linux
and copying itself to them. Once it infected a machine, it patched that same vulnerability, installed a rootkit
, and sent the system's identity to an e-mail address coded in the worm.
An unusual feature of this worm was its calling card that made infected systems easily identifiable: It replaced all files on the system named "index.html
" with a modified version with the page title "Ramen Crew", containing the following text and image link:
The referenced image is no longer available on the indicated server.
Computer worm
A computer worm is a self-replicating malware computer program, which uses a computer network to send copies of itself to other nodes and it may do so without any user intervention. This is due to security shortcomings on the target computer. Unlike a computer virus, it does not need to attach...
that spread in January 2001, targeting systems running versions 6.2 and 7.0 of the Red Hat
Red Hat
Red Hat, Inc. is an S&P 500 company in the free and open source software sector, and a major Linux distribution vendor. Founded in 1993, Red Hat has its corporate headquarters in Raleigh, North Carolina with satellite offices worldwide....
Linux distribution.
This worm propagated using a brute force technique, searching the Internet for other machines running Red Hat Linux
Red Hat Linux
Red Hat Linux, assembled by the company Red Hat, was a popular Linux based operating system until its discontinuation in 2004.Red Hat Linux 1.0 was released on November 3, 1994...
and copying itself to them. Once it infected a machine, it patched that same vulnerability, installed a rootkit
Rootkit
A rootkit is software that enables continued privileged access to a computer while actively hiding its presence from administrators by subverting standard operating system functionality or other applications...
, and sent the system's identity to an e-mail address coded in the worm.
An unusual feature of this worm was its calling card that made infected systems easily identifiable: It replaced all files on the system named "index.html
Webserver directory index
When an HTTP client requests a URL that points to a directory structure instead of an actual Web page within the directory, the Web server will generally serve a general page, which is often referred to as a main or "index" page....
" with a modified version with the page title "Ramen Crew", containing the following text and image link:
- RameN Crew
- Hackers looooooooooooooooove noodles.
- This site powered by
[image: http://www.nissinfoods.com/tr_oriental.jpg]
The referenced image is no longer available on the indicated server.