The debian-private mailing list leak, part 1. Volunteers have complained about Blackmail. Lynchings. Character assassination. Defamation. Cyberbullying. Volunteers who gave many years of their lives are picked out at random for cruel social experiments. The former DPL's girlfriend Molly de Blanc is given volunteers to experiment on for her crazy talks. These volunteers never consented to be used like lab rats. We don't either. debian-private can no longer be a safe space for the cabal. Let these monsters have nowhere to hide. Volunteers are not disposable. We stand with the victims.
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Possible Security hole: telnetd 1.3.x

> Why do you think that somebody got in without a password? The lines
> above only show that the last command that was executed was in.telnetd
> (remember that the lastlog info is in reverse order). The lines above
> look normal to me.
> 
Here's a more sane version(with a  little self hacked accounting reader)
(and other logs thrown in... note there were no last entries for this
login, but were entries before and after)

FFFF and 4CC are device ID's FFFF is obviously no controling TTY...
4CC is one of the pty's

Sep  2 00:56:09 demon in.telnetd[21161]: connect from the.ravennet.net
root    in.telnetd      FFFF    Tue Sep  2 00:56:09 1997
root    uname   4CC     Tue Sep  2 00:56:24 1997
root    mesg    4CC     Tue Sep  2 00:56:24 1997
root    bash    4CC     Tue Sep  2 00:56:24 1997
root    bash    4CC     Tue Sep  2 00:56:31 1997
root    cat     4CC     Tue Sep  2 00:56:38 1997
root    bash    4CC     Tue Sep  2 00:56:38 1997
root    bash    4CC     Tue Sep  2 00:56:13 1997
(Now, I cant even login as root from telnet...)
(lastlog, last faillog all show nothing, auth.log shows no su's)
(I wasn't awake, and neither was the person below at the time either login
happened...)
Sep  2 00:57:06 demon in.telnetd[21169]: connect from the.ravennet.net
root    in.telnetd      FFFF    Tue Sep  2 00:57:06 1997
yamara uname 4CC 	Tue Sep 2 00:57:19 1997
yamara  bash    4CC     Tue Sep  2 00:57:19 1997
yamara  talk    4CC     Tue Sep  2 00:57:56 1997
yamara  bash    4CC     Tue Sep  2 00:57:57 1997
yamara  w       4CC     Tue Sep  2 00:57:59 1997
yamara  bash    4CC     Tue Sep  2 00:58:01 1997
yamara  bash    4CC     Tue Sep  2 00:58:08 1997
yamara  talk    4CC     Tue Sep  2 00:58:12 1997
yamara  bash    4CC     Tue Sep  2 01:32:33 1997
yamara  w       4CC     Tue Sep  2 01:32:37 1997
yamara  bash    4CC     Tue Sep  2 01:32:38 1997
yamara  more    4CC     Tue Sep  2 01:32:52 1997
yamara  netstat 4CC     Tue Sep  2 01:32:52 1997
yamara  bash    4CC     Tue Sep  2 01:33:02 1997
yamara  bash    4CC     Tue Sep  2 00:57:07 1997



--
TO UNSUBSCRIBE FROM THIS MAILING LIST: e-mail the word "unsubscribe" to
debian-private-request@lists.debian.org . 
Trouble?  e-mail to templin@bucknell.edu .