full-disclosure - sshd logins without a source

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4E7C00DF.6060202@blackhat.bz>
Date: Fri, 23 Sep 2011 11:45:35 +0800
From: BH <lists@...ckhat.bz>
To: full-disclosure@...ts.grok.org.uk
Subject: sshd logins without a source

Hi,

I am taking a look at a few different servers that have been rooted at
around the same time. At the time of the compromise I can see in each
servers sshd logs an entry like the following:

Sep 22 12:57:14 test-vm sshd[25002]: pam_unix(sshd:session): session
opened for user root by (uid=0)
Sep 22 12:57:32 test-vm sshd[25002]: pam_unix(sshd:session): session
closed for user root

Each of the servers has the same sort of entry in the log that match
with the time that extra processes were being executed. Having a look at
all other available logs (that were logged remotely) I can't see
anything else that relates to the same event. To me it seems odd that
there is no IP address corresponding with the login, I can't seem to
reproduce that on my test servers. I also can't see the authentication
method used as that isn't logged. Has anyone seen this before and know
how this is done?

Thanks

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/