[37418] in Hotline Meeting
m11-113
daemon@ATHENA.MIT.EDU (kretch@MIT.EDU)
Sun Mar 16 14:08:39 1997
To: ops@MIT.EDU, hotline@MIT.EDU
Cc: hacked_ws@MIT.EDU
From: kretch@MIT.EDU
Date: Sun, 16 Mar 1997 14:08:26 EST
So I came over to see what was up. The machines didn't seem to have
anything out of the ordinary on login. (although there's a large
poster over the glass window now that says something like "So long and
thanks for all the fish") The only thing around on the machines is:
athena% ls -l /etc/athena/login/fish.gif
-rw------- 1 root other 968 Mar 16 05:01 /etc/athena/login/fish.gif
athena% ls -l /etc/athena/login/xv
-rwx------ 1 root other 1394408 Mar 16 05:01 /etc/athena/login/xv
(hmm, odd ownership) Everything else seemed to be untouched (and so
nothing ever called it) I also noted that every workstation I logged
in to had been rebooted since the hack but long after they had been
hacked (ex. this one at 10:50) I guess whatever they did didn't last
beyond a reboot. Did one of reboot all the machines?
xv fish.gif (as root of course) just produced a small replica of the
banner now covering the window.
kretch
