lkml.org 
[lkml]   [1997]   [Jan]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Subject[Offtopic] Russian Hacker
Date
Hi,

excuse me because of this offtopic, but I think this is also very
interesting to You (good programers).

At Dec 30 we had a visit of someone from sampo.karelia.ru.
We don't know where he got the passwd of one of our users,
but ... shit happens.

The first thing he/she/it did was downloading two files named:
my_lib and my_library.so (attached).

Two days after that (main logs are cleared), he got the root-password.
Don't ask me how, it is a shadow System with /etc/shadow readonly for
root.

He/she/it installed a new /etc/shadow with himself as a user and
installed a tcp/ip-snooper to get more passwords.

NOW MY QUESTION IS HOW DID HE GET THE PASSWORD? Maybe with my_lib* ?
May someone have a look at this files, please and mail me his comment?


And beware from logins of these hosts:

sampo.karelia.ru
kftt-runnet.karelia.ru
www.ci.houston.tx.us
ashton.lib.dixie.edu
ferret-world.csc.peachnet.edu
gw.kppublish.ru

Best wishes for the new year,

Harald

--
Harald Hoyer
saturn@studbox.uni-stuttgart.de
http://saturnnet.wh.uni-stuttgart.de/~saturn
-------------------------------------------------------------------------
> Someone:
> Asking Linus to add such things in the kernel is as pertinent as asking
> to still support 80286 CPU (IMHO).
We are working on it.
Alan Cox
[unhandled content-type:application/octet-stream][unhandled content-type:application/octet-stream]
\
 
 \ /
  Last update: 2005-03-22 13:38    [W:0.058 / U:4.632 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site