From owner-freebsd-hackers  Sun Jun 23 18:41:01 1996
Return-Path: owner-hackers
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.5/8.7.3) id SAA11154
          for hackers-outgoing; Sun, 23 Jun 1996 18:41:01 -0700 (PDT)
Received: from time.cdrom.com (time.cdrom.com [204.216.27.226])
          by freefall.freebsd.org (8.7.5/8.7.3) with ESMTP id SAA11129;
          Sun, 23 Jun 1996 18:40:53 -0700 (PDT)
Received: from time.cdrom.com (localhost [127.0.0.1]) by time.cdrom.com (8.7.5/8.6.9) with ESMTP id SAA08380; Sun, 23 Jun 1996 18:40:26 -0700 (PDT)
To: Amancio Hasty <hasty@rah.star-gate.com>
cc: hackers@FreeBSD.org, security@FreeBSD.org, ache@FreeBSD.org
Subject: Re: I need help on this one - please help me track this guy down! 
In-reply-to: Your message of "Sun, 23 Jun 1996 18:32:25 PDT."
             <199606240132.SAA01869@rah.star-gate.com> 
Date: Sun, 23 Jun 1996 18:40:25 -0700
Message-ID: <8378.835580425@time.cdrom.com>
From: "Jordan K. Hubbard" <jkh@time.cdrom.com>
Sender: owner-hackers@FreeBSD.org
X-Loop: FreeBSD.org
Precedence: bulk

> Also since "you" were logged in , try to look in the logs for a 
> a loggin session of a foreign host and I would report the incident  to the
> FBI 8)

All we have are the "last" logs, which show:

jkh       ttyp2    a235.pu.ru       Sun Jun 23 16:50 - 17:18  (00:28)
jkh       ttyp3    a235.pu.ru       Sun Jun 23 15:00 - 15:34  (00:33)

If someone at the russian site could help correlate this time (PST) to
the local time at wherever a235.ru.pu came in from, we could at least
narrow down which user(s) it might have been.

Also, I think that calling the FBI on this one is only likely to get
me put on infinite hold when they hear that the perpetrator is in
Russia. :-)

					Jordan