[1141] in Release_7.7_team
notes, 10/28
daemon@ATHENA.MIT.EDU (Mike Barker)
Wed Oct 29 10:27:29 1997
To: release-team@MIT.EDU
Date: Wed, 29 Oct 1997 10:27:24 EST
From: Mike Barker <mbarker@MIT.EDU>
Attending: ghudson, wdc, mbarker, danw, othomas, ajfox, jweiss,
cfields
1. 8.1.13 went out to the Athena cell.
2. we discussed perl 5 a little.
- there may be some breakage of perl scripts when we change
over.
- we should collect notes on what kind of breakage (what does
it look like and how do you fix it) during our testing
- we should think about how to publicize the change and what
to recommend that users do if a perl script breaks
3. We discussed the hack (a skull and crossbones, etc.) a bit.
Action items we saw:
1. jweiss will make sure that it is reported to those who
should take proper action against the hackers.
2. we will investigate whether we can run an "auto-cleanup"
over the accounts that were infected. at least some 2300 accounts
were infected. while we may be able to fix affected .cshrc files
where they are not customized, there will be other cases where we can
only warn the user. we also may want to warn the user about
.netscaperc and ... directories, if found.
3. we can (and probably should) do a lert notification to
those who are obviously infected.
4. we should investigate whether we can provide a "disinfect"
script (or program) that will help a user remove the problem.
5. we could provide a "viruscheck" script/program that would
help users identify whether they have been infected.
6. we may also simply provide directions:
- diff /usr/prototype_user/.cshrc ~/.cshrc
- ls -l .netscaperc ...
to check for signs of the virus
- cp /usr/prototype_user/.cshrc ~/.cshrc
- rm .netscaperc
- mv ~/... ~/hackdir && rm -rf ~/hackdir
to remove the virus
4. mime - please review and comment on Larry Stone's proposal
[1135 in release-77 discuss meeting]
