Re: A friend's cable modem Linux machine just got compromised

From: Sam Trenholme (abiword_bugsat_private)
Date: Wed May 01 2002 - 13:39:26 PDT

  • Next message: Mark Newby: "Tuxkit (Optic Kit?) -cracked (/dev/tux)" 

    > xntps on the sun box was a mstream client if I
> remember.

xntps here seems to be a hybrid between the NTP
(network time protocol) server and version 1.2.27 of
the ssh server; running strings on the offending
binary shows the various login and authentication
strings that ssh uses.

- Sam


_________________________________________________________
Do You Yahoo!?
La emoción e intensidad del deporte en Yahoo! Deportes. http://deportes.yahoo.com.mx

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

    This archive was generated by hypermail 2b30 : Thu May 02 2002 - 08:17:48 PDT