This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.
------_=_NextPart_001_01C04D91.70417AB0
Content-Type: text/plain;
charset="iso-8859-1"
A couple years back I tried logging into my isp's telnet account as
nobody(with a blank pw) - and got in! I think I left a little message for
them somewhere too, telling them what i did. I don't know how much damage I
could have done, I was even greener then than I am now :)
-----Original Message-----
From: Armin Hartinger [
mailto:armin@pctechware.com]
Sent: Sunday, November 12, 2000 1:05 AM
To:
Plug-discuss@lists.PLUG.phoenix.az.us
Subject: got cracked!
drwxrwxrwx 7 110 203 4096 Nov 4 22:45 .
drwxr-xr-x 14 110 203 4096 Sep 24 12:04 ..
-rw-r--r-- 1 armin armin 2326 Sep 25 18:25 apache_pb.gif
drwxrwxr-x 2 armin armin 4096 Sep 25 18:27 deborah
drwxrwxrwx 4 armin armin 4096 Oct 10 14:45 dev
-rw-r--r-- 1 root ftp 1431 Oct 24 20:06 index.html
drwxrwxrwx 2 armin armin 4096 Nov 11 17:01 kristen
drwxrwxrwx 3 armin armin 4096 Nov 11 16:08 lauren
drwxrwxrwx 7 110 203 4096 Aug 16 1999 manual
-rw-r--r-- 1 root ftp 66 Oct 24 20:04 old.html
[armin@gateway /www]$
Someone hacked into my little Linux gateway box. He defaced index.html and
saved the old one as old.html
That he appears as root/ftp, is that an indication how he got in?
I had anon. ftp running, using the default one RH 6.2 ships with (wu-2.6.0).
I suppose I have to completely re-setup that box, I just would like to know
what hole to close there.
Any ideas?
If anybody wants to see the deface before I fix by box:
http://24.221.63.194/ <
http://24.221.63.194/>
------_=_NextPart_001_01C04D91.70417AB0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 5.50.4522.1800" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><SPAN class=3D418084516-13112000><FONT face=3DArial =
color=3D#0000ff size=3D2>A=20
couple years back I tried logging into my isp's telnet account as =
nobody(with a=20
blank pw) - and got in! I think I left a little message for them =
somewhere too,=20
telling them what i did. I don't know how much damage I could have =
done, I was=20
even greener then than I am now :)</FONT></SPAN></DIV>
<BLOCKQUOTE dir=3Dltr style=3D"MARGIN-RIGHT: 0px">
<DIV class=3DOutlookMessageHeader dir=3Dltr align=3Dleft><FONT =
face=3DTahoma=20
size=3D2>-----Original Message-----<BR><B>From:</B> Armin Hartinger=20
[
mailto:armin@pctechware.com]<BR><B>Sent:</B> Sunday, November 12, =
2000 1:05=20
AM<BR><B>To:</B> =
Plug-discuss@lists.PLUG.phoenix.az.us<BR><B>Subject:</B> got=20
cracked!<BR><BR></FONT></DIV>
<DIV><FONT face=3DArial size=3D2>drwxrwxrwx 7=20
110 =20
203 4096 =
Nov 4=20
22:45 .<BR>drwxr-xr-x 14 =
110 =20
203 4096 Sep 24 =
12:04=20
..<BR>-rw-r--r-- 1 armin =20
armin 2326 Sep 25 18:25=20
apache_pb.gif<BR>drwxrwxr-x 2 =
armin =20
armin 4096 Sep 25 18:27=20
deborah<BR>drwxrwxrwx 4 armin =20
armin 4096 Oct 10 14:45=20
dev<BR>-rw-r--r-- 1 root =20
ftp 1431 Oct 24 =
20:06=20
index.html<BR>drwxrwxrwx 2 armin =20
armin 4096 Nov 11 17:01=20
kristen<BR>drwxrwxrwx 3 armin =20
armin 4096 Nov 11 16:08=20
lauren<BR>drwxrwxrwx 7 =
110 =20
203 4096 Aug =
16 =20
1999 manual<BR>-rw-r--r-- 1 =
root =20
ftp =
66 Oct=20
24 20:04 old.html<BR>[armin@gateway=20
=
/www]$ =
=
=
=
=20
</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Someone hacked into my little Linux =
gateway box.=20
He defaced index.html and saved the old one as old.html</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>That he appears as root/ftp, is that =
an=20
indication how he got in?</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>I had anon. ftp running, using the =
default one RH=20
6.2 ships with (wu-2.6.0).</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>I suppose I have to completely =
re-setup that box,=20
I just would like to know what hole to close there.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Any ideas?</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>If anybody wants to see the deface =
before I=20
fix by box: <A=20
href=3D"
http://24.221.63.194/">
http://24.221.63.194/</A></FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial =
size=3D2></FONT> </DIV></BLOCKQUOTE></BODY></HTML>
------_=_NextPart_001_01C04D91.70417AB0--
&CC=LucasVogellvogel@exponent.com&Body=On%202000-11-13%2016:47,%20LucasVogellvogel@exponent.com%20wrote:%0A>%20This%20message%20is%20in%20MIME%20format.%20Since%20your%20mail%20reader%20does%20not%20understand%0A>%20this%20format,%20some%20or%20all%20of%20this%20message%20may%20not%20be%20legible.%0A>%20%0A>%20%0A>%20A%20couple%20years%20back%20I%20tried%20logging%20into%20my%20isp's%20telnet%20account%20as%0A>%20nobody(with%20a%20blank%20pw)%20-%20and%20got%20in!%20I%20think%20I%20left%20a%20little%20message%20for%0A>%20them%20somewhere%20too,%20telling%20them%20what%20i%20did.%20I%20don't%20know%20how%20much%20damage%20I%0A>%20could%20have%20done,%20I%20was%20even%20greener%20then%20than%20I%20am%20now%20:)%0A>%20%0A>%20-----Original%20Message-----%0A>%20From:%20Armin%20Hartinger%20%5Bmailto:armin@pctechware.com%5D%0A>%20Sent:%20Sunday,%20November%2012,%202000%201:05%20AM%0A>%20To:%20Plug-discuss@lists.PLUG.phoenix.az.us%0A>%20Subject:%20got%20cracked!%0A>%20%0A>%20%0A>%20%0A>%20%20%0A>%20Someone%20hacked%20into%20my%20little%20Linux%20gateway%20box.%20He%20defaced%20index.html%20and%0A>%20saved%20the%20old%20one%20as%20old.html%0A>%20That%20he%20appears%20as%20root/ftp,%20is%20that%20an%20indication%20how%20he%20got%20in?%0A>%20%20%0A>%20I%20had%20anon.%20ftp%20running,%20using%20the%20default%20one%20RH%206.2%20ships%20with%20(wu-2.6.0).%0A>%20%20%0A>%20I%20suppose%20I%20have%20to%20completely%20re-setup%20that%20box,%20I%20just%20would%20like%20to%20know%0A>%20what%20hole%20to%20close%20there.%0A>%20%20%0A>%20Any%20ideas?%0A>%20%20%0A>%20If%20anybody%20wants%20to%20see%20the%20deface%20before%20I%20fix%20by%20box:%0A>%20http://24.221.63.194/%20<http://24.221.63.194/>%20%0A>%20%20%0A>%20%20%0A>%20%0A>%20%0A>%20%0A>%20<!DOCTYPE%20HTML%20PUBLIC%20%22-//W3C//DTD%20HTML%204.0%20Transitional//EN%22>%0A>%20<HTML><HEAD>%0A>%20<META%20HTTP-EQUIV=3D%22Content-Type%22%20CONTENT=3D%22text/html;%20=%0A>%20charset=3Diso-8859-1%22>%0A>%20%0A>%20%0A>%20<META%20content=3D%22MSHTML%205.50.4522.1800%22%20name=3DGENERATOR>%0A>%20<STYLE></STYLE>%0A>%20</HEAD>%0A>%20<BODY%20bgColor=3D#ffffff>%0A>%20<DIV><SPAN%20class=3D418084516-13112000><FONT%20face=3DArial%20=%0A>%20color=3D#0000ff%20size=3D2>A=20%0A>%20couple%20years%20back%20I%20tried%20logging%20into%20my%20isp's%20telnet%20account%20as%20=%0A>%20nobody(with%20a=20%0A>%20blank%20pw)%20-%20and%20got%20in!%20I%20think%20I%20left%20a%20little%20message%20for%20them%20=%0A>%20somewhere%20too,=20%0A>%20telling%20them%20what%20i%20did.%20I%20don't%20know%20how%20much%20damage%20I%20could%20have%20=%0A>%20done,%20I%20was=20%0A>%20even%20greener%20then%20than%20I%20am%20now%20:)</FONT></SPAN></DIV>%0A>%20<BLOCKQUOTE%20dir=3Dltr%20style=3D%22MARGIN-RIGHT:%200px%22>%0A>%20%20%20<DIV%20class=3DOutlookMessageHeader%20dir=3Dltr%20align=3Dleft><FONT%20=%0A>%20face=3DTahoma=20%0A>%20%20%20size=3D2>-----Original%20Message-----<BR><B>From:</B>%20Armin%20Hartinger=20%0A>%20%20%20%5Bmailto:armin@pctechware.com%5D<BR><B>Sent:</B>%20Sunday,%20November%2012,%20=%0A>%202000%201:05=20%0A>%20%20%20AM<BR><B>To:</B>%20=%0A>%20Plug-discuss@lists.PLUG.phoenix.az.us<BR><B>Subject:</B>%20got=20%0A>%20%20%20cracked!<BR><BR></FONT></DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20size=3D2>drwxrwxrwx %207=20%0A>%20%20%20110 =20%0A>%20%20%20203 %204096%20=%0A>%20Nov %204=20%0A>%20%20%2022:45%20.<BR>drwxr-xr-x %2014%20=%0A>%20110 =20%0A>%20%20%20203 %204096%20Sep%2024%20=%0A>%2012:04=20%0A>%20%20%20..<BR>-rw-r--r-- %201%20armin =20%0A>%20%20%20armin %202326%20Sep%2025%2018:25=20%0A>%20%20%20apache_pb.gif<BR>drwxrwxr-x %202%20=%0A>%20armin =20%0A>%20%20%20armin %204096%20Sep%2025%2018:27=20%0A>%20%20%20deborah<BR>drwxrwxrwx %204%20armin =20%0A>%20%20%20armin %204096%20Oct%2010%2014:45=20%0A>%20%20%20dev<BR>-rw-r--r-- %201%20root =20%0A>%20%20%20ftp %201431%20Oct%2024%20=%0A>%2020:06=20%0A>%20%20%20index.html<BR>drwxrwxrwx %202%20armin =20%0A>%20%20%20armin %204096%20Nov%2011%2017:01=20%0A>%20%20%20kristen<BR>drwxrwxrwx %203%20armin =20%0A>%20%20%20armin %204096%20Nov%2011%2016:08=20%0A>%20%20%20lauren<BR>drwxrwxrwx %207%20=%0A>%20110 =20%0A>%20%20%20203 %204096%20Aug%20=%0A>%2016 =20%0A>%20%20%201999%20manual<BR>-rw-r--r-- %201%20=%0A>%20root =20%0A>%20%20%20ftp %20=%0A>%2066%20Oct=20%0A>%20%20%2024%2020:04%20old.html<BR>%5Barmin@gateway=20%0A>%20%20%20=%0A>%20/www%5D%24 =%0A>%20 =%0A>%20 =%0A>%20 =%0A>%20 =20%0A>%20%20%20</FONT></DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20size=3D2></FONT> </DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20size=3D2>Someone%20hacked%20into%20my%20little%20Linux%20=%0A>%20gateway%20box.=20%0A>%20%20%20He%20defaced%20index.html%20and%20saved%20the%20old%20one%20as%20old.html</FONT></DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20size=3D2>That%20he%20appears%20as%20root/ftp,%20is%20that%20=%0A>%20an=20%0A>%20%20%20indication%20how%20he%20got%20in?</FONT></DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20size=3D2></FONT> </DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20size=3D2>I%20had%20anon.%20ftp%20running,%20using%20the%20=%0A>%20default%20one%20RH=20%0A>%20%20%206.2%20ships%20with%20(wu-2.6.0).</FONT></DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20size=3D2></FONT> </DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20size=3D2>I%20suppose%20I%20have%20to%20completely%20=%0A>%20re-setup%20that%20box,=20%0A>%20%20%20I%20just%20would%20like%20to know%20what%20hole%20to%20close%20there.</FONT></DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20size=3D2></FONT> </DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20size=3D2>Any%20ideas?</FONT></DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20size=3D2></FONT> </DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20size=3D2>If%20anybody%20wants%20to%20see%20the%20deface%20=%0A>%20before%20I=20%0A>%20%20%20fix by%20box:%20<A=20%0A>%20%20%20href=3D%22http://24.221.63.194/%22>http://24.221.63.194/</A></FONT></DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20size=3D2></FONT> </DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20=%0A>%20size=3D2></FONT> </DIV></BLOCKQUOTE></BODY></HTML>%0A>%20%0A>%20------_=_NextPart_001_01C04D91.70417AB0--%0A>%20%0A>%20%0A>%20%0A>%20%0A>%20 "Reply to this message")
(text/plain)