lkml.org 
[lkml]   [1997]   [Jan]   [3]   [last100]   RSS Feed
Views: [more markup]  [less markup]  [headers]  [forward] 
 
Messages in this thread
/
FromHarald Hoyer <>
Subject[Offtopic] Russian Hacker
DateThu, 02 Jan 1997 22:05:15 -0100
Hi,

excuse me because of this offtopic, but I think this is also very
interesting to You (good programers).

At Dec 30 we had a visit of someone from sampo.karelia.ru.
We don't know where he got the passwd of one of our users, 
but ... shit happens.

The first thing he/she/it did was downloading two files named:
my_lib and my_library.so (attached). 

Two days after that (main logs are cleared), he got the root-password.
Don't ask me how, it is a shadow System with /etc/shadow readonly for
root. 

He/she/it installed a new /etc/shadow with himself as a user and
installed a tcp/ip-snooper to get more passwords.

NOW MY QUESTION IS HOW DID HE GET THE PASSWORD? Maybe with my_lib* ?
May someone have a look at this files, please and mail me his comment?


And beware from logins of these hosts:

sampo.karelia.ru
kftt-runnet.karelia.ru
www.ci.houston.tx.us
ashton.lib.dixie.edu
ferret-world.csc.peachnet.edu
gw.kppublish.ru

Best wishes for the new year,

	Harald

-- 
Harald Hoyer  
saturn@studbox.uni-stuttgart.de 
http://saturnnet.wh.uni-stuttgart.de/~saturn
-------------------------------------------------------------------------
> Someone:
> Asking Linus to add such things in the kernel is as pertinent as asking 
> to still support 80286 CPU (IMHO).
We are working on it.
Alan Cox[unhandled content-type:application/octet-stream][unhandled content-type:application/octet-stream]
\
 
 \ /
  Last update: 2005-03-22 12:38    [from the cache]
©2003-2008