From: Ville Herva <vherva@mail.niksula.cs.hut.fi>
To: "Richard B. Johnson" <root@chaos.analogic.com>
Cc: kernel@ddx.a2000.nu, linux-kernel@vger.kernel.org,
Enforcer <enforcer@ddx.a2000.nu>
Subject: [OT] Re: Strange errors in /var/log/messages
Date: Mon, 2 Jul 2001 21:23:16 +0300 [thread overview]
Message-ID: <20010702212316.X1503@niksula.cs.hut.fi> (raw)
In-Reply-To: <Pine.LNX.4.30.0107021800410.5490-100000@ddx.a2000.nu> <Pine.LNX.3.95.1010702125419.5216A-100000@chaos.analogic.com>
In-Reply-To: <Pine.LNX.3.95.1010702125419.5216A-100000@chaos.analogic.com>; from root@chaos.analogic.com on Mon, Jul 02, 2001 at 01:00:33PM -0400
On Mon, Jul 02, 2001 at 01:00:33PM -0400, you [Richard B. Johnson] claimed:
> > Jul 2 15:12:16 gateway SERVER[1240]: Dispatch_input: bad request line
> > 'BBXXXXXXXXXXXXXXXXXX%.176u%3
> > 00$nsecurity.%301$n%302$n%.192u%303$n\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\22
> > 0\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\22
>
> I think you just got 'rooted'. Look at /etc/inetd.conf (if it exists
> on your system, the xinetd is more robust). It may have a new entry
> on its last line providing a root shell to anybody. This looks somewhat
> like an attack shown by CERN about 6 to 12 months ago.
(This has nothing to do with linux-kernel, sorry...)
I don't think anything particular in that message suggests he actually got
rooted? It just seems that somebody tried to exploit lprNG hole (or
something else) and the daemon logged that. Of course, it *is* perfectly
possible, that he _got_ rooted (although he said he was running redhat-7.0
with all the updates).
(The attacker may have tried other attacks so if he got rooted, those above
are not necessarily the related log messages. In any case, a 'smart' intruder
would have cleaned the log. Also, 'smart' attacker propably uses something
more advanced as backdoor than /etc/inetd.conf these days.)
Or is there something that actually indicates a succesfull intrusion in the
log snippet that I'm missing?
-- v --
v@iki.fi
prev parent reply other threads:[~2001-07-02 18:23 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2001-07-02 16:05 kernel
2001-07-02 16:11 ` Remco B. Brink
2001-07-02 16:16 ` Alan Cox
2001-07-02 17:42 ` Guest section DW
2001-07-02 19:51 ` kernel
2001-07-03 7:45 ` David Weinehall
2001-07-02 17:00 ` Richard B. Johnson
2001-07-02 18:23 ` Ville Herva [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20010702212316.X1503@niksula.cs.hut.fi \
--to=vherva@mail.niksula.cs.hut.fi \
--cc=enforcer@ddx.a2000.nu \
--cc=kernel@ddx.a2000.nu \
--cc=linux-kernel@vger.kernel.org \
--cc=root@chaos.analogic.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®