[95169] in RedHat Linux List
Re: port 111
daemon@ATHENA.MIT.EDU (Statux)
Thu Oct 15 17:09:21 1998
Reply-To: "Statux" <statux@bigfoot.com>
From: "Statux" <statux@bigfoot.com>
To: <redhat-list@redhat.com>
Date: Thu, 15 Oct 1998 22:08:31 +0100
Resent-From: redhat-list@redhat.com
This is a multi-part message in MIME format.
------=_NextPart_000_000C_01BDF888.5861FF60
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
damn async sockets :P
-----Original Message-----
From: Emmanuel Papirakis <Emmanuel_Papirakis@UQTR.UQuebec.CA>
To: redhat-list@redhat.com <redhat-list@redhat.com>
Date: Thursday, October 15, 1998 1:08 PM
Subject: port 111
>Hey,
>
> one of my friends got hacked throw port 111. This port was opened because
of his nfs daemon. The problem is that the program /bin/login has been
replaced by some sort of fake. Also, finger and who don't show any users, no
matter how many virtual consols we are logged on.
>
> I think this guy has installed some kind of root-kit on his machine. Does
anyone know of such root-kit, how they work, how to fix the damage and how
to prevent being hacked throw that port?
>
> Will stopping nfs daemon do the trick? ANd, what if you want to do some
nfs, is there a safe way?
>
>
> Papi
>
>
>--
> PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
> http://www.redhat.com http://archive.redhat.com
> To unsubscribe: mail redhat-list-request@redhat.com with
> "unsubscribe" as the Subject.
>
>
>
------=_NextPart_000_000C_01BDF888.5861FF60
Content-Type: text/x-vcard;
name="Statux.vcf"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
filename="Statux.vcf"
BEGIN:VCARD
VERSION:2.1
N:;Statux
FN:Statux
NOTE;ENCODING=3DQUOTED-PRINTABLE:I am the Vice President of !Daemon =
Clan!.=3D0D=3D0A
ADR;HOME:;;;;Pennsylvania;;USA
LABEL;HOME;ENCODING=3DQUOTED-PRINTABLE:Pennsylvania=3D0D=3D0AUSA
URL:http://www.geocities.com/TimesSquare/Ring/3818/
EMAIL;INTERNET:statux@bigfoot.com
EMAIL;PREF;INTERNET:statux@hotmail.com
EMAIL;INTERNET:statux@geocities.com
REV:19981015T210830Z
END:VCARD
------=_NextPart_000_000C_01BDF888.5861FF60--
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
http://www.redhat.com http://archive.redhat.com
To unsubscribe: mail redhat-list-request@redhat.com with
"unsubscribe" as the Subject.
