On Tue, 29 Jul 1997, Heikki Suonsivu wrote:

=) =)Vincent Poy writes: =) > Machines are offline already. The hacker confronted us and said =) > that it was the default .rhosts file that came in the FreeBSD root account =) > and he used perl5.00401 which had a security hole and then used rlogin to =) > login to another machine without the password. =) =)There is no default .rhosts file in FreeBSD, so the hacker is probably =)trying to avoid telling you what was the real hole. =) =)Just for reference, there are large number of irc scripts which contain =)backdoors (often well-disguised), which usually create .rhosts file with "+ =)+" in it. The easiest way is to trick someone in the machine to run one of =)those scripts and it opens the machine, then use one of the FreeBSD =)holes or local misconfigurations to open the rest.

I might just have gotten carried away about the .rhosts thing. You're probably right about the .rhosts file because it's in my directory on this machine but not in the root directory and the contents are just: # This file should NOT be group or other readable. #OtherMachine #OtherMachine myFriend

I haven't used irc like for a few years. The machine is a irc server though. Not the one he originally hacked but the one he hacked after he hacked the first one.

Cheers, Vince - vin...@MCESTATE.COM - vin...@GAIANET.NET ________ __ ____ Unix Networking Operations - FreeBSD-Real Unix for Free / / / / | / |[__ ] GaiaNet Corporation - M & C Estate / / / / | / | __] ] Beverly Hills, California USA 90210 / / / / / |/ / | __] ] HongKong Stars/Gravis UltraSound Mailing Lists Admin /_/_/_/_/|___/|_|[____]