From owner-freebsd-hackers  Sun Jun 23 19:01:37 1996
Return-Path: owner-hackers
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.5/8.7.3) id TAA12340
          for hackers-outgoing; Sun, 23 Jun 1996 19:01:37 -0700 (PDT)
Received: from rah.star-gate.com (rah.star-gate.com [204.188.121.18])
          by freefall.freebsd.org (8.7.5/8.7.3) with ESMTP id TAA12320;
          Sun, 23 Jun 1996 19:01:27 -0700 (PDT)
Received: from rah.star-gate.com (localhost.v-site.net [127.0.0.1]) by rah.star-gate.com (8.7.5/8.7.3) with ESMTP id TAA02005; Sun, 23 Jun 1996 19:01:17 -0700 (PDT)
Message-Id: <199606240201.TAA02005@rah.star-gate.com>
X-Mailer: exmh version 1.6.5 12/11/95
To: "Jordan K. Hubbard" <jkh@time.cdrom.com>
cc: hackers@FreeBSD.org, security@FreeBSD.org, ache@FreeBSD.org
Subject: Re: I need help on this one - please help me track this guy down! 
In-reply-to: Your message of "Sun, 23 Jun 1996 18:40:25 PDT."
             <8378.835580425@time.cdrom.com> 
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Sun, 23 Jun 1996 19:01:17 -0700
From: Amancio Hasty <hasty@rah.star-gate.com>
Sender: owner-hackers@FreeBSD.org
X-Loop: FreeBSD.org
Precedence: bulk

I would report it nevertheless and who knows they may even have
e-mail... Also, I am a bit concerned that he tried to erase your
home directory because he/she probably had something in that directory.

Also if you report it , it may help you in the case that the
person was trying to do something really nasty.

BTW: It could be a woman in that case it may be difficult to get
her balls 8)

	Amancio


>From The Desk Of "Jordan K. Hubbard" :
> > Also since "you" were logged in , try to look in the logs for a 
> > a loggin session of a foreign host and I would report the incident  to the
> > FBI 8)
> 
> All we have are the "last" logs, which show:
> 
> jkh       ttyp2    a235.pu.ru       Sun Jun 23 16:50 - 17:18  (00:28)
> jkh       ttyp3    a235.pu.ru       Sun Jun 23 15:00 - 15:34  (00:33)
> 
> If someone at the russian site could help correlate this time (PST) to
> the local time at wherever a235.ru.pu came in from, we could at least
> narrow down which user(s) it might have been.
> 
> Also, I think that calling the FBI on this one is only likely to get
> me put on infinite hold when they hear that the perpetrator is in
> Russia. :-)
> 
> 					Jordan