Messages in this thread | | | From | "Nicholas J. Leon" <> | Subject | Re: [Offtopic] Russian Hacker | Date | Fri, 3 Jan 1997 10:28:10 -0500 (EST) |
| |
Nicolas St-Pierre was overheard whispering ... # There should be a fixed telnetd somewhere you can use that limits # environment variables. Or you can recompile telnetd.
Statically is best. To prevent sh*t like this from happening, I've recompiled all my (similar) daemons statically....
# # Nick. # # On Thu, 2 Jan 1997, Harald Hoyer wrote: # # > Hi, # > # > excuse me because of this offtopic, but I think this is also very # > interesting to You (good programers). # > # > At Dec 30 we had a visit of someone from sampo.karelia.ru. # > We don't know where he got the passwd of one of our users, # > but ... shit happens. # > # > The first thing he/she/it did was downloading two files named: # > my_lib and my_library.so (attached). # > # > Two days after that (main logs are cleared), he got the root-password. # > Don't ask me how, it is a shadow System with /etc/shadow readonly for # > root. # > # > He/she/it installed a new /etc/shadow with himself as a user and # > installed a tcp/ip-snooper to get more passwords. # > # > NOW MY QUESTION IS HOW DID HE GET THE PASSWORD? Maybe with my_lib* ? # > May someone have a look at this files, please and mail me his comment? # > # > # > And beware from logins of these hosts: # > # > sampo.karelia.ru # > kftt-runnet.karelia.ru # > www.ci.houston.tx.us # > ashton.lib.dixie.edu # > ferret-world.csc.peachnet.edu # > gw.kppublish.ru # > # > Best wishes for the new year, # > # > Harald # > # > -- # > Harald Hoyer # > saturn@studbox.uni-stuttgart.de # > http://saturnnet.wh.uni-stuttgart.de/~saturn # > ------------------------------------------------------------------------- # > > Someone: # > > Asking Linus to add such things in the kernel is as pertinent as asking # > > to still support 80286 CPU (IMHO). # > We are working on it. # > Alan Cox # > #
N! ------------------------------------------------------------------------------ Nicholas J. Leon nicholas@binary9.net "Elegance through Simplicity" http://www.binary9.net/nicholas "Adrenaline takes you, to the next level, you're dancing the dance with the digital devil."
| |