Re: hack that changes root to Root

From: Mike Shaw (mshawat_private)
Date: Tue Feb 26 2002 - 13:00:22 PST

Next message: Matthew Leeds: "Re: Determining the country of orgin for IP address(es)"

Previous message: Michael Sutton: "Wave of Nimda-like hits this morning?"
In reply to: James: "hack that changes root to Root"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

I've seen a sophisticated Trojan horse program that does this.

It basically tricks me into hitting the insert key in vi which capitalizes 
the letter.  This is particularly on the very first letter on the very 
first line where the cursor starts (like "root" in etc/passwd).  So far I 
haven't seen a publicly available exploit, so I have no idea how it knows 
I'm in a hurry and been living in notepad all day. ; )

-Mike

At 05:49 PM 2/25/2002 -0700, James wrote:
>Anyone know of a hack that changes root (user name) to Root ?
>
>James Edwards
>jameshat_private
>At the Santa Fe Office: Internet at Cyber Mesa
>Store hours: 9-6 Monday through Friday
>Phone support 365 days till 10 pm via the Santa Fe office:
>505-988-9200 or Toll Free: 888-988-2700
>
>
>
>----------------------------------------------------------------------------
>This list is provided by the SecurityFocus ARIS analyzer service.
>For more information on this free incident handling, management
>and tracking system please see: http://aris.securityfocus.com

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Matthew Leeds: "Re: Determining the country of orgin for IP address(es)"
Previous message: Michael Sutton: "Wave of Nimda-like hits this morning?"
In reply to: James: "hack that changes root to Root"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue Feb 26 2002 - 14:24:38 PST