lkml.org 
[lkml]   [1997]   [Jan]   [3]   [last100]   RSS Feed
Views: [more markup]  [less markup]  [headers]  [forward] 
 
Messages in this thread
/
From"Nicholas J. Leon" <>
SubjectRe: [Offtopic] Russian Hacker
DateFri, 3 Jan 1997 10:28:10 -0500 (EST)
Nicolas St-Pierre was overheard whispering ...
 # There should be a fixed telnetd somewhere you can use that limits 
 # environment variables.  Or you can recompile telnetd.

Statically is best. To prevent sh*t like this from happening, I've
recompiled all my (similar) daemons statically....
 # 
 # Nick.
 # 
 # On Thu, 2 Jan 1997, Harald Hoyer wrote:
 # 
 # > Hi,
 # > 
 # > excuse me because of this offtopic, but I think this is also very
 # > interesting to You (good programers).
 # > 
 # > At Dec 30 we had a visit of someone from sampo.karelia.ru.
 # > We don't know where he got the passwd of one of our users, 
 # > but ... shit happens.
 # > 
 # > The first thing he/she/it did was downloading two files named:
 # > my_lib and my_library.so (attached). 
 # > 
 # > Two days after that (main logs are cleared), he got the root-password.
 # > Don't ask me how, it is a shadow System with /etc/shadow readonly for
 # > root. 
 # > 
 # > He/she/it installed a new /etc/shadow with himself as a user and
 # > installed a tcp/ip-snooper to get more passwords.
 # > 
 # > NOW MY QUESTION IS HOW DID HE GET THE PASSWORD? Maybe with my_lib* ?
 # > May someone have a look at this files, please and mail me his comment?
 # > 
 # > 
 # > And beware from logins of these hosts:
 # > 
 # > sampo.karelia.ru
 # > kftt-runnet.karelia.ru
 # > www.ci.houston.tx.us
 # > ashton.lib.dixie.edu
 # > ferret-world.csc.peachnet.edu
 # > gw.kppublish.ru
 # > 
 # > Best wishes for the new year,
 # > 
 # > 	Harald
 # > 
 # > -- 
 # > Harald Hoyer  
 # > saturn@studbox.uni-stuttgart.de 
 # > http://saturnnet.wh.uni-stuttgart.de/~saturn
 # > -------------------------------------------------------------------------
 # > > Someone:
 # > > Asking Linus to add such things in the kernel is as pertinent as asking 
 # > > to still support 80286 CPU (IMHO).
 # > We are working on it.
 # > Alan Cox
 # > 
 # 


N!
------------------------------------------------------------------------------
Nicholas J. Leon                                          nicholas@binary9.net
"Elegance through Simplicity"                  http://www.binary9.net/nicholas
                "Adrenaline takes you, to the next level, you're
                  dancing the dance with the digital devil."


\
 
 \ /
  Last update: 2005-03-22 12:38    [from the cache]
©2003-2008