Re: hack that changes root to Root

From: james (jameshat_private)
Date: Tue Feb 26 2002 - 14:17:34 PST

  • Next message: zeno: "Re: IIS Server Log security breach?"

    rootXXXXXXXXXXXXXdaemon:0:0:System Administrator:/root:/bin/csh
    
    
    This is from the command vipw, and "root" was "Root", changed all 'root'
    ownership changed to Root.
    Only 3 people know roots passwd, and a look at their keystaoke history
    indicates none changed root to Root
    
    
    
    
    
    
    ----- Original Message -----
    From: "Yotam Rubin" <yotamat_private>
    To: <incidentsat_private>
    Sent: Tuesday, February 26, 2002 12:17 PM
    Subject: Re: hack that changes root to Root
    
    
    > On Mon, Feb 25, 2002 at 05:49:05PM -0700, James wrote:
    > > Anyone know of a hack that changes root (user name) to Root ?
    >
    > The login name or the real name? The former is abstractly achieved by
    > "cat /etc/{passwd,shadow} | sed 's/^root:/Root/'". This may break some
    > scripts you currently use, and well, the security gain is insignificant.
    >
    > Regards, Yotam Rubin
    >
    > >
    > > James Edwards
    > > jameshat_private
    > > At the Santa Fe Office: Internet at Cyber Mesa
    > > Store hours: 9-6 Monday through Friday
    > > Phone support 365 days till 10 pm via the Santa Fe office:
    > > 505-988-9200 or Toll Free: 888-988-2700
    > >
    > >
    > >
    >
    > --------------------------------------------------------------------------
    --
    > > This list is provided by the SecurityFocus ARIS analyzer service.
    > > For more information on this free incident handling, management
    > > and tracking system please see: http://aris.securityfocus.com
    > >
    >
    > --------------------------------------------------------------------------
    --
    > This list is provided by the SecurityFocus ARIS analyzer service.
    > For more information on this free incident handling, management
    > and tracking system please see: http://aris.securityfocus.com
    >
    >
    
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Tue Feb 26 2002 - 17:10:20 PST