Update: Hacked?

From: Joe Fletcher <joe_at_meng.ucl.ac.uk>
Date: Fri, 03 Mar 2000 17:47:20 +0111

Hi All,

> All of a sudden the login prompts on an ES40 system have changed to
> -s> for everyone. I'm thinking it's been hacked but so far I've not found
> anything. Any and all suggestions welcome.
>
> Just to make things more fun, the machine is at a remote site and the
> network links have chosen now to go out to lunch. Can't you just tell it's
> Friday?

Ok. The links just came back up. The prompt thing is solved. The hostname
had been set to "-s". Also there was an extra character inserted into
the printcap file which broke one of the print queues. I'm guessing I'm
going to find more little tweaks like this. I'm also guessing someone has
got hold of the root password and been toying with the system.
If this is so it will suck greatly.


Joe
Received on Fri Mar 03 2000 - 17:49:00 NZDT

This archive was generated by hypermail 2.4.0 : Wed Nov 08 2023 - 11:53:40 NZDT