From owner-freebsd-security  Wed Feb  6  3: 5:52 2002
Delivered-To: freebsd-security@freebsd.org
Received: from memphis.mephi.ru (memphis.mephi.ru [194.67.67.234])
	by hub.freebsd.org (Postfix) with ESMTP id B3F6F37B404
	for <freebsd-security@FreeBSD.ORG>; Wed,  6 Feb 2002 03:05:46 -0800 (PST)
Received: (from timon@localhost)
	by memphis.mephi.ru (8.11.6/8.11.3) id g16B5Uo33060;
	Wed, 6 Feb 2002 14:05:30 +0300 (MSK)
	(envelope-from timon)
Date: Wed, 6 Feb 2002 14:05:30 +0300 (MSK)
From: "Artem 'Zazoobr' Ignatjev" <timon@memphis.mephi.ru>
Message-Id: <200202061105.g16B5Uo33060@memphis.mephi.ru>
To: brett@lariat.org, freebsd-security@FreeBSD.ORG,
	victor@customdynamic.net
Subject: Re: Is this evidence of a break-in attempt?
In-Reply-To: <4.3.2.7.2.20020205125336.02758450@localhost>
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

> From owner-freebsd-security@FreeBSD.ORG Tue Feb  5 22:59:39 2002
> Date: Tue, 05 Feb 2002 12:54:41 -0700
> To: Victor Grey <victor@customdynamic.net>, <freebsd-security@FreeBSD.ORG>
> From: Brett Glass <brett@lariat.org>
> Subject: Re: Is this evidence of a break-in attempt?
>
> In a word, yes. Looks like they went to the box with a
> keyboard and a mouse, rebooted, and tried to log in.
> Clearly, they were so clueless that they did not know
> about single-user mode.
>
Well, if console is marked as `insecure' (which is MY default policy) 
single mode couldn't help them too much. 
But there is a way to get contents of any file in root filesystem from
loader(8), so they could get root hash.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message