solaris lpd, KARMAPOLICE?

From: Ricky Vludmore (ricky2kat_private)
Date: Wed Aug 29 2001 - 01:47:26 PDT

  • Next message: NESTING, DAVID M (SBCSI): "RE: Weird Incoming IP's and port numbers."

    
     ('binary' encoding is not supported, stored as-is)
    I have a SunOS 5.8 system with a printer attached to it (used to service print requests on my company's network). It's a fairly 
    busy printer. It's accessible via the Internet, with reason. 
    
    Yesterday I went to investigate why a large batch of jobs had 
    frozen. I discovered that they had been erased. Strange 
    considering that nobody else has access to this machine and 
    I haven't seen it happen before. I snooped around and noticed
    some very strange activity, namely what appeared to be signs
    of an intrusion- idle shell processes and other abnormalities.
    Not thinking, I pulled the plug :-(
    
    The only indication of an intrusion now is a log file that 
    shows someone requesting a print request to or from a 
    "KARMAPOLICE" printer/server which I don't recognize at 
    all. 
        
    Ring any bells?
    
    
    
    ------------------------------------------------------------
    This email was sent through the free email service at http://www.anonymous.to/
    To report abuse, please visit our website and click "Contact Us."
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Wed Aug 29 2001 - 08:27:26 PDT