From owner-freebsd-security@FreeBSD.ORG Wed Feb 25 20:56:22 2015 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id AD58EA14 for ; Wed, 25 Feb 2015 20:56:22 +0000 (UTC) Received: from briareus.schulte.org (briareus.schulte.org [198.204.225.190]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 7A4BB82A for ; Wed, 25 Feb 2015 20:56:22 +0000 (UTC) Received: from briareus.schulte.org (localhost [127.0.0.1]) by briareus.schulte.org (Postfix) with ESMTP id 3DE6B40801; Wed, 25 Feb 2015 14:55:44 -0600 (CST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=schulte.org; h=from:to :cc:subject:date:message-id:references:in-reply-to:content-type :content-id:content-transfer-encoding:mime-version; s=20130123; i=christopher@schulte.org; bh=roSBhIIZAh3Y3D2BiT41J6erS1gFOeVIl RTzPAK6A1I=; b=ecMyNG7cz+ouWLFexlzlpbEC6OQAiVL/QRjuJlY5fpiPY23FQ mQRxfpVT3SM8LCWSNYG2sjWhp8MvwmnGimEKMCW/OpW1DLxk3bDbu60Tx0rydJf1 63MVFNY9fU8IeZSE4r80AepjfR7xeTuEQls0mw6RfHJLS2wceyuwxZ2s8I= x-schulte-info1: relayed through postfix client submission Received: from exchange2013.windows2012r2.schulte.org (10.200.1.188) by exchange2013.windows2012r2.schulte.org (10.200.1.188) with Microsoft SMTP Server (TLS) id 15.0.847.32; Wed, 25 Feb 2015 14:55:43 -0600 Received: from exchange2013.windows2012r2.schulte.org ([fe80::695c:2eae:3d60:8cd7]) by exchange2013.windows2012r2.schulte.org ([fe80::695c:2eae:3d60:8cd7%16]) with mapi id 15.00.0847.030; Wed, 25 Feb 2015 14:55:43 -0600 From: Christopher Schulte To: Philip Jocks Subject: Re: has my 10.1-RELEASE system been compromised Thread-Topic: has my 10.1-RELEASE system been compromised Thread-Index: AQHQUTRPlHoaFq2Xw0CAp6YGLFOGpZ0CLdyA//+cf1iAAAW0kIAAZvyAgAAF9wA= Date: Wed, 25 Feb 2015 20:55:43 +0000 Message-ID: <30A97E9B-5719-4DA3-ADFB-24A3FADF6D3C@schulte.org> References: <864mq9zsmm.fsf@gly.ftfl.ca> <54EE2A19.7050108@FreeBSD.org> <86vbipycyc.fsf@gly.ftfl.ca> <1B20A559-59C5-477A-A2F3-9FD7E16C09E8@netzkommune.com> <86k2z5yc03.fsf@gly.ftfl.ca> <4EE57C1F-AB10-4BF1-A193-DB9C75A586FC@netzkommune.com> In-Reply-To: <4EE57C1F-AB10-4BF1-A193-DB9C75A586FC@netzkommune.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-schulteexchange-note1: origination IP removed Content-Type: text/plain; charset="utf-8" Content-ID: <52773E1C00FB4743876BF5D4200C3971@windows2012r2.schulte.org> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Virus-Scanned: ClamAV using ClamSMTP Cc: Joseph Mingrone , "freebsd-security@freebsd.org" X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Feb 2015 20:56:22 -0000 DQo+IE9uIEZlYiAyNSwgMjAxNSwgYXQgMjozNCBQTSwgUGhpbGlwIEpvY2tzIDxwamxpc3RzQG5l dHprb21tdW5lLmNvbT4gd3JvdGU6DQo+IA0KPiBpdCBmZWx0IHByZXR0eSBzY2FtbXkgdG8gbWUs IGdvb2dsaW5nIGZvciB0aGUgIndvcm0iIGdvdCBtZSB0byBya2NoZWNrLm9yZyB3aGljaCB3YXMg cmVnaXN0ZXJlZCBhIGZldyBkYXlzIGFnbyBhbmQgbG9va3MgbGlrZSBhIHRhbXBlcmVkIHZlcnNp b24gb2YgY2hrcm9vdGtpdC4gSSBob3BlLCBub2JvZHkgaW5zdGFsbGVkIGl0IGFueXdoZXJlLCBp dCBzZWVtcyB0byBleGVjdXRlIHJrY2hlY2svdGVzdHMvLnVuaXQvdGVzdC5zaCB3aGljaCBjb250 YWlucyANCj4gDQo+ICMhL2Jpbi9iYXNoDQo+IA0KPiBjcCB0ZXN0cy8udW5pdC90ZXN0IC91c3Iv YmluL3Jyc3luY24NCj4gY2htb2QgK3ggL3Vzci9iaW4vcnJzeW5jbg0KPiBybSAtZnIgL2V0Yy9y YzIuZC9TOThyc3luY24NCj4gbG4gLXMgL3Vzci9iaW4vcnJzeW5jbiAvZXRjL3JjMi5kL1M5OHJz eW5jbg0KPiAvdXNyL2Jpbi9ycnN5bmNuDQo+IGV4aXQNCj4gDQo+IFRoYXQgZG9lc24ndCBsb29r IGxpa2Ugc29tZXRoaW5nIHlvdSdkIHdhbnQgb24geW91ciBib3jigKYNCg0KSSBmaWxlZCBhIHJl cG9ydCB3aXRoIEdvb2dsZSBhYm91dCB0aGF0IGRvbWFpbiAoR29vZ2xlIFNhZmUgQnJvd3Npbmcp LCBicmllZmx5IGRlc2NyaWJpbmcgd2hhdOKAmXMgYmVlbiByZWNvdW50ZWQgaGVyZSBvbiB0aGlz IHRocmVhZC4gIEl0IHNlZW1zIHF1aXRlIHN1c3BpY2lvdXMsIGFncmVlZC4NCg0KSGFzIGFueW9u ZSBzdGFydGVkIGFuIGFuYWx5c2lzIG9mIHRoZSBycnN5bmNuIGJpbmFyeT8gIFRoZSBsYXN0IGZl dyBsaW5lcyBvZiBhIHNpbXBsZSBzdHJpbmcgZHVtcCBhcmUgaW50ZXJlc3RpbmfigKYgdGFrZSBu b3RlIHdoYXQgbG9va3MgdG8gYmUgYW4gSVAgYWRkcmVzcyBvZiA5NS4yMTUuNDQuMTk1Lg0KDQov YmluL3NoDQppcHRhYmxlcyAtWCAyPiAvZGV2L251bGwNCmlwdGFibGVzIC1GIDI+IC9kZXYvbnVs bA0KaXB0YWJsZXMgLXQgbmF0IC1GIDI+IC9kZXYvbnVsbA0KaXB0YWJsZXMgLXQgbmF0IC1YIDI+ IC9kZXYvbnVsbA0KaXB0YWJsZXMgLXQgbWFuZ2xlIC1GIDI+IC9kZXYvbnVsbA0KaXB0YWJsZXMg LXQgbWFuZ2xlIC1YIDI+IC9kZXYvbnVsbA0KaXB0YWJsZXMgLVAgSU5QVVQgQUNDRVBUIDI+IC9k ZXYvbnVsbA0KaXB0YWJsZXMgLVAgRk9SV0FSRCBBQ0NFUFQgMj4gL2Rldi9udWxsDQppcHRhYmxl cyAtUCBPVVRQVVQgQUNDRVBUIDI+IC9kZXYvbnVsbA0KdWRldmQNCjk1LjIxNS40NC4xOTUNCjsq MyQiDQoNCj4gQ2hlZXJzLA0KPiANCj4gUGhpbGlwDQoNCkNocmlz