From owner-freebsd-security  Tue Mar 27 13: 0:26 2001
Delivered-To: freebsd-security@freebsd.org
Received: from scientia.demon.co.uk (scientia.demon.co.uk [212.228.14.13])
	by hub.freebsd.org (Postfix) with ESMTP id C114737B729
	for <freebsd-security@freebsd.org>; Tue, 27 Mar 2001 13:00:20 -0800 (PST)
	(envelope-from ben@scientia.demon.co.uk)
Received: from strontium.scientia.demon.co.uk ([fec0::2e0:7dff:fe81:749d])
	by scientia.demon.co.uk with esmtp (Exim 3.22 #1)
	id 14i0Ze-000A4c-00; Tue, 27 Mar 2001 22:00:18 +0100
Received: (from ben@localhost)
	by strontium.scientia.demon.co.uk (8.11.3/8.11.3) id f2RL0Iv66332;
	Tue, 27 Mar 2001 22:00:18 +0100 (BST)
	(envelope-from ben)
Date: Tue, 27 Mar 2001 22:00:17 +0100
From: Ben Smithurst <ben@FreeBSD.org>
To: "Michael A. Dickerson" <mikey@singingtree.com>
Cc: Michael Lucas <mlucas@gltg.com>, freebsd-security@freebsd.org
Subject: Re: weird daily check output
Message-ID: <20010327220017.G789@strontium.scientia.demon.co.uk>
References: <99q631$2htl$1@FreeBSD.csie.NCTU.edu.tw> <00af01c0b6fe$79176a60$db9497cf@singingtree.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <00af01c0b6fe$79176a60$db9497cf@singingtree.com>
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

Michael A. Dickerson wrote:

> So far it's looking like it could be hardware .. but what's very suspicious
> is the corruption of the rest of the kernel messages, which is clearly not
> random (lowercase letters->uppercase, etc).  That's probably why people
> accused you of faking the message, since it's hard to think of any
> explanation except maybe a particularly juvenile kiddie getting hold of
> /dev/kmem?

Uppercase to lowercase is a one bit change, so it's possible that it's
faulty memory.  Most of the other changes seem to be like that:

>>> isa0: <ISA$bus> on isab0

space == 0x20, dollar == 0x24

>>> p#i0: <UHCI USB controlle2> at 31,2 irq 9

c == 0x63, # == 0x23

etc...

-- 
Ben Smithurst / ben@FreeBSD.org / PGP: 0x99392F7D

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message