![]() | |||||||||||||
Messages in this thread |
Hi, excuse me because of this offtopic, but I think this is also very interesting to You (good programers). At Dec 30 we had a visit of someone from sampo.karelia.ru. We don't know where he got the passwd of one of our users, but ... shit happens. The first thing he/she/it did was downloading two files named: my_lib and my_library.so (attached). Two days after that (main logs are cleared), he got the root-password. Don't ask me how, it is a shadow System with /etc/shadow readonly for root. He/she/it installed a new /etc/shadow with himself as a user and installed a tcp/ip-snooper to get more passwords. NOW MY QUESTION IS HOW DID HE GET THE PASSWORD? Maybe with my_lib* ? May someone have a look at this files, please and mail me his comment? And beware from logins of these hosts: sampo.karelia.ru kftt-runnet.karelia.ru www.ci.houston.tx.us ashton.lib.dixie.edu ferret-world.csc.peachnet.edu gw.kppublish.ru Best wishes for the new year, Harald -- Harald Hoyer saturn@studbox.uni-stuttgart.de http://saturnnet.wh.uni-stuttgart.de/~saturn ------------------------------------------------------------------------- > Someone: > Asking Linus to add such things in the kernel is as pertinent as asking > to still support 80286 CPU (IMHO). We are working on it. Alan Cox[unhandled content-type:application/octet-stream][unhandled content-type:application/octet-stream] | ||||||||||||
| Last update: 2005-03-22 12:38 [from the cache] ©2003-2008 | |||||||||||||