full-disclosure - Patched Solaris Boxes being Hacked??

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040105142606.L18397-100000@birmingham-infragard.org>
From: daniel_clemens at autism.birmingham-infragard.org (daniel uriah clemens)
Subject: Patched Solaris Boxes being Hacked??

The attack could be as simple as the attacker fingering the boxes, viewing
who is logged in and then brute forcing the logins via ftp and then
logging into the boxes.

What other information was found on the compromised boxes?
Was there a specific trojan ?
Where there any other log files on the box?

What about the timeline of files accessed, modified, and or deleted on the
box.

> into networks of patched Solaris 8 machines. Initial analysis indicates what
> appears to be a multi-vector attack, using finger, rpcbind, and ftp. In one
> network, the systems that got broken into did not have tcpwrappers installed
> nor did they have the rpcbind from Wietse Venema and Casper Dik that has
> tcpwrapper support. However, there were Solaris 8 systems in the same
> machine room that are behind on patches, but have tcp wrappers installed and
> they were not broken into. If there have been other cases of similar
> intrusions in the past few days, the Storm Center would like to hear about
> it."

-Daniel Uriah Clemens

Esse quam videra
     (to be, rather than to appear)
	             -Moments of Sorrow are Moments of Sobriety
http://www.birmingham-infragard.org   | 2053284200
fingerprint: EDF0 6566 2A4A 220E 5760  EA1F 0424 6DF6 F662 F5BD