Date: Mon, 28 Jul 1997 17:03:19 -0700 (PDT) From: Vincent Poy <vince@mail.MCESTATE.COM> To: "Jordan K. Hubbard" <jkh@time.cdrom.com> Cc: security@FreeBSD.ORG, "[Mario1-]" <mario1@PrimeNet.Com>, JbHunt <johnnyu@accessus.net> Subject: Re: security hole in FreeBSD Message-ID: <Pine.BSF.3.95.970728170156.3844H-100000@mail.MCESTATE.COM> In-Reply-To: <5496.870134385@time.cdrom.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, 28 Jul 1997, Jordan K. Hubbard wrote: =)> Well, because I connect to the system using telnet ;) Also, this =) =)That proves absolutely nothing. You think I can't hack a telnetd to =)provide multiple "services?" Wake up, Vinnie! :-) Ofcourse you could but you're not in the same type of hacking business this guy is in. This is a log of a irc chat session. >From johnnyu@accessus.net Mon Jul 28 17:01:43 1997 Date: Mon, 28 Jul 1997 18:38:32 -0500 (CDT) From: NoHackMe! <johnnyu@accessus.net> To: security@netcom.com Cc: vince@mcestate.com, mario1@primenet.com Subject: Logs (Gaianet.net) Here is a log I just got from talking with theca the hacker! Session Start: Mon Jul 28 18:16:14 1997 [18:16] <TheCa> yeah [18:16] <TheCa> hi [18:16] <TheCa> wasup <JbHuNt> that was nice of you <JbHuNt> last night [18:16] <TheCa> what? pasting the root pass all over efnet? <JbHuNt> yea [18:16] <TheCa> so was icmp pinging me <JbHuNt> you shouldn't have hacked the machine [18:17] <TheCa> i was nice till that started <JbHuNt> aside from that the minor ping that you got was nothing <JbHuNt> you have created a HUGE DOS situation for the entire company [18:17] <TheCa> i'll show you all the pings i got [18:17] <TheCa> 1 sec. <JbHuNt> I don't care? [18:17] <TheCa> ok <JbHuNt> You were pinged <JbHuNt> why? [18:18] <TheCa> why am i causing a dos? [18:18] <TheCa> bring your machines back up <JbHuNt> well let's see you changed the root passwd <JbHuNt> handed it out [18:18] <TheCa> Jul 28 02:29:45 soma icmplog: ping from venus.GAIANET.NET [18:18] <TheCa> Jul 28 02:30:19 soma last message repeated 10 times [18:18] <TheCa> Jul 28 02:31:20 soma last message repeated 18 times [18:18] <TheCa> Jul 28 02:32:04 soma last message repeated 64 times [18:18] <TheCa> Jul 28 02:38:52 soma last message repeated 31 times [18:18] <TheCa> Jul 28 02:39:53 soma last message repeated 54 times [18:18] <TheCa> Jul 28 02:40:54 soma last message repeated 60 times [18:18] <TheCa> Jul 28 02:41:37 soma last message repeated 42 times [18:18] <TheCa> i changed the root passwd to 'root' <JbHuNt> someone changed the inetd.conf and rebooted [18:18] <TheCa> yeah [18:18] <TheCa> i didn't do that <JbHuNt> so now all the machines are pretty much denying all hosts <JbHuNt> we don't care to much [18:19] <TheCa> one of the windows lusers who saw my paste <JbHuNt> as far as we're concerned your the cause of the problem [18:19] <TheCa> umm [18:19] <TheCa> why don't you fix the inetd.conf <JbHuNt> let's put it like this [18:19] <TheCa> instead of bitching about it <JbHuNt> that system is admin'd remotely <JbHuNt> that system is admin'd remotely [18:20] <TheCa> so NO one has physical access to the machine? <JbHuNt> your actions caused the main unix boxes on the lan <JbHuNt> not at the present time the owners are out of the country [18:20] <TheCa> so go drive over there or something and boot it up [18:20] <TheCa> i told you the root pass... <JbHuNt> anything I did to you was in an attempt to thwart your efforts to take control <JbHuNt> all of my feable efforts failed <JbHuNt> your a super leet spoof aren't you who's caching your dns [18:22] <TheCa> i'm caching it [18:22] <TheCa> on an authorative ns box i rooted <JbHuNt> Hmm that neet [18:23] <TheCa> yep <JbHuNt> That would explain why netcom security can't find you on the portmaster ________________________________________ | TheCa (theca@wil-de7-10.ix.netcom.com) | name : No bodies ever knew... | serv : irc.pacbell.net [18:24] <TheCa> tell netcom to change the !root pass on some of their portmasters [18:24] <TheCa> just to be umm safe [18:25] <TheCa> netcom has no security...it's a joke <JbHuNt> that's good [18:25] <TheCa> netcom shell security is great [18:25] <TheCa> ppp security == null [18:26] <TheCa> they've got the biggest REAL isp (not including aol, etc)...you think they can keep track or even try to keep track of everyone? [18:26] <TheCa> they have well over half a million users <JbHuNt> you think they can find you? <JbHuNt> you think they can find you? Session Close: Mon Jul 28 18:32:07 1997 [18:28] <TheCa_> Jul 28 19:28:14 soma pppd[16376]: Modem hangup [18:28] <TheCa_> Jul 28 19:28:14 soma pppd[16376]: Connection terminated. [18:28] <TheCa_> Jul 28 19:28:14 soma pppd[16376]: Exit. [18:29] <TheCa_> *clap clap* [18:29] <TheCa_> nice [18:30] <TheCa_> i'll see if that netcom acct is still up <JbHuNt> he probably doesn't have the account (!) The time is now 6:30pm. [18:30] <TheCa_> something like "connect S0" or the port <JbHuNt> they just dumped the entire wilmington port [18:30] <TheCa_> ah [18:30] <TheCa_> heh [18:30] <TheCa_> that's stupid [18:30] <TheCa_> now there's no way they'll find me ________________________________________ | TheCa_ (theca@phd-as15s15.erols.com) That's it John basically he admits it and implies he has control over at least one of your portmasters and possibly one of your dns servers. This is a serious security issue for us and should be for you. If you have ANY contacts at erols.com please forward this to them and cc us if you would. John Urschel Gaianet Unix Administrator Cheers, Vince - vince@MCESTATE.COM - vince@GAIANET.NET ________ __ ____ Unix Networking Operations - FreeBSD-Real Unix for Free / / / / | / |[__ ] GaiaNet Corporation - M & C Estate / / / / | / | __] ] Beverly Hills, California USA 90210 / / / / / |/ / | __] ] HongKong Stars/Gravis UltraSound Mailing Lists Admin /_/_/_/_/|___/|_|[____]
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.3.95.970728170156.3844H-100000>