From owner-freebsd-security  Fri Jun 20 18:33:55 1997
Return-Path: <owner-security>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.5/8.8.5) id SAA07240
          for security-outgoing; Fri, 20 Jun 1997 18:33:55 -0700 (PDT)
Received: from aries.bb.cc.wa.us (root@[208.8.136.11])
          by hub.freebsd.org (8.8.5/8.8.5) with ESMTP id SAA07235
          for <freebsd-security@FreeBSD.ORG>; Fri, 20 Jun 1997 18:33:53 -0700 (PDT)
Received: from localhost (chris@localhost) by aries.bb.cc.wa.us (8.8.5/8.6.9) with SMTP id SAA11913; Fri, 20 Jun 1997 18:31:52 -0700 (PDT)
Date: Fri, 20 Jun 1997 18:31:52 -0700 (PDT)
From: Chris Coleman <chris@bb.cc.wa.us>
To: Daniel Baker <dbaker@hobbes.cuckoo.com>
cc: Pedro A M Vazquez <vazquez@IQM.Unicamp.BR>, freebsd-security@FreeBSD.ORG
Subject: Re: Attempt to compromise root
In-Reply-To: <199706202301.SAA27594@hobbes.cuckoo.com>
Message-ID: <Pine.NEB.3.94.970620183022.11897A-100000@aries.bb.cc.wa.us>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-security@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

I am in the .us domain and you are right, it let me in just fine.  I
looked around a little and found the standard linux-root-kit and a few
other interesting programs. I'll have to be more careful.

Christopher J. Coleman (chris@aries.bb.cc.wa.us)
Computer Support Technician I  (509)-766-8873
Big Bend Community College  Internet Instructor
FreeBSD Book Project:  http://vinyl.quickweb.com/~chrisc/book.html
Disclaimer: Even Though it has My Name on it, Doesn't mean I said it.

On Fri, 20 Jun 1997, Daniel Baker wrote:

> > 
> > It still working for me (second try):
> > 
> > ftp the.art.of.sekurity.org
> > Connected to the.art.of.sekurity.org.
> > 220 the.art.of FTP server (Version wu-2.4(1) Tue Aug 8 15:50:43 CDT 1995) ready.
> > Name (the.art.of.sekurity.org:vazquez): anonymous
> > 331 Guest login ok, send your complete e-mail address as password.
> > Password:
> > 230 Guest login ok, access restrictions apply.
> > Remote system type is UNIX.
> > Using binary mode to transfer files.
> 
> I still can't ftp in. I imagine he disabeled access for .com and .net (or
> something like that) and since you're in .br, you wouldn't be denied
> access.
> 
> [snip]
> 
> Thanks
> 
> Daniel
> 
> [snip]
> 
> -- 
> Daniel Baker (dbaker@cuckoo.com)
> Chief Technology and Executive Officer -- CuckooNet! (http://www.cuckoo.com)
>