[12506] in Hotline Meeting
possible security problem
daemon@ATHENA.MIT.EDU (peteh@Athena.MIT.EDU)
Wed Dec 23 08:59:46 1992
From: peteh@Athena.MIT.EDU
To: hotline@Athena.MIT.EDU
Date: Wed, 23 Dec 92 08:59:32 EST
This just came in to olc:
Log Initiated for user Fei Hai Chua (fhchua@E40-008-4.MIT.EDU [0]).
[Wed 23-Dec-92 8:50am]
Topic: unix
Question:
Someone might be messing around with our mail system too. I just sent a mailminute a go
from my account and it was to the mailing list fynet-admin.
The message didn't come out as me as the sender. Instead it says something
like:
Received: from E40-008-4.MIT.EDU by Athena.MIT.EDU with SMTP
id AA11546; Wed, 23 Dec 92 08:45:06 EST
Received: by e40-008-4 (5.57/4.7) id AA01839; Wed, 23 Dec 92 08:45:04 -0500
Message-Id: <9212231345.AA01839@e40-008-4>
To: fynet-admin@Athena.MIT.EDU
Subject: Thanks for all the support!
Date: Wed, 23 Dec 92 08:45:03 EST
From: The Unknown User-ID (15383) <intruder@Athena.MIT.EDU>
Please look into that.
Also, at dialup server, if we type in "ls" instead of "athena" or "dec"...
we'll get into a weired machine, which I think is copying in our password.
I am pretty sure about that. It some times behave like a fake loggin which
is set up intentionally. Correct me if I am wrong, but do take a look
and see what is going wrong.
Thanks.
-Fei
Machine info:
Processor: DECstation Maxine
Display : Color DS Maxine
Memory : 0x1252000 user; 0x1800000 (24 M) total
___________________________________________________________
-----------
Peter Henderson (617) 253-3460
MIT CSS Consulting
11-124H
