[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Savannah-hackers] subversions hacked?
From: |
Hugo Gayosso |
Subject: |
[Savannah-hackers] subversions hacked? |
Date: |
Tue, 18 Mar 2003 22:32:38 -0500 |
User-agent: |
Gnus/5.09 (Gnus v5.9.0) Emacs/21.2 |
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
I guess some of you already saw this message, but I didn't see any
comments on either system-hackers nor on savannah-hackers, so here it
is:
I am truncating parts of the message, in summary a lot if not all of
the shell accounts in subversions were removed from '/etc/passwd' and
a bunch of other accounts (suspicious usernames) were created:
From: address@hidden (subversions's file diff daemon)
Subject: subversions:/etc/passwd -- recent changes
To: address@hidden
Date: Tue, 18 Mar 2003 04:00:20 -0500
Reply-To: address@hidden
This is an automated report from subversions.
Recent changes to /etc/passwd:
252 -rw-r--r-- 1 root root 251121 Mar 17 12:26 /etc/passwd
diff -u0 /home/diffmon/old_file_dir/subversions:!etc!passwd.gz /etc/passwd
- --- /tmp/diffmon9404 Tue Mar 18 04:00:19 2003
+++ /etc/passwd Mon Mar 17 12:26:14 2003
@@ -36,153 +36,30 @@
- -anoncvs:x:1003:1003:Anony Mouse Read-only CVS
User:/home/empty:/usr/local/bin/cvssh
- -michael:x:1004:65534:Michael Hanni
<address@hidden>:/home/michael:/usr/local/bin/cvssh
- -jonas:x:1042:65534:Jonas Öberg <address@hidden>:/home/jonas:/bin/bash
- -thomas:x:9107:65534:Thomas Bushnell, BSG
<address@hidden>:/home/thomas:/bin/bash
- -kwzh:x:31508:65534:Karl Heuer <address@hidden>:/home/kwzh:/usr/bin/rc
- -mhw:x:31613:65534:Mark H. Weaver <address@hidden>:/home/mhw:/bin/bash
- -alex:x:60001:65534:Alexander Langer
<address@hidden>:/home/alex:/usr/local/bin/cvssh
[ truncated for brevity ]
+0rfelyus:x:62520:65534:Daniel Skarda
<address@hidden>:/home/0rfelyus:/usr/local/bin/cvssh
+1984:x:60357:65534:M.-A. DARCHE
<address@hidden>:/home/1984:/usr/local/bin/cvssh
+3diff:x:60216:65534:Brian Youmans
<address@hidden>:/home/3diff:/usr/local/bin/cvssh
+AGustan:x:61602:65534:Aurelien Gustan
<address@hidden>:/home/AGustan:/usr/local/bin/cvssh
+AaronM:x:61539:65534:Aaron M.
<address@hidden>:/home/AaronM:/usr/local/bin/cvssh
+AdamFSmith:x:62452:65534:Adam F. Smith
<address@hidden>:/home/AdamFSmith:/usr/local/bin/cvssh
+Agamenon:x:62196:65534:Raul Garita Chacón
<address@hidden>:/home/Agamenon:/usr/local/bin/cvssh
+Aiua:x:63183:65534:Adrien de Sentenac
<address@hidden>:/home/Aiua:/usr/local/bin/cvssh
+AlwaysGoodTimes:x:63188:65534:Zurab Davitiani
<address@hidden>:/home/AlwaysGoodTimes:/usr/local/bin/cvssh
+Ankh:x:62421:65534:Liam Quin <address@hidden>:/home/Ankh:/usr/local/bin/cvssh
+ArauKo:x:62748:65534:Luis Araujo
<address@hidden>:/home/ArauKo:/usr/local/bin/cvssh
+ArbreVert:x:62743:65534:ArbreVert
<address@hidden>:/home/ArbreVert:/usr/local/bin/cvssh
+Arvoreen:x:63205:65534:Paul Bettinger
<address@hidden>:/home/Arvoreen:/usr/local/bin/cvssh
[ truncated for brevity ]
- -mirko:x:60178:65534:Mirko Viviani
<address@hidden>:/home/mirko:/usr/local/bin/cvssh
- -lmiguel:x:60179:65534:Luis Miguel Arteaga Mejía
<address@hidden>:/home/lmiguel:/usr/local/bin/cvssh
- -csillag:x:60180:65534:Csillag Kristóf
<address@hidden>:/home/csillag:/usr/local/bin/cvssh
- -paulv:x:60181:65534:Paul Visscher <address@hidden>:/home/paulv:/bin/bash
- -srbaker:x:60184:65534:Steven R. Baker
<address@hidden>:/home/srbaker:/usr/local/bin/cvssh
- -jagapen:x:60185:65534:Jonathan Gapen
<address@hidden>:/home/jagapen:/usr/local/bin/cvssh
- -nico:x:60186:65534:Nicola Pero
<address@hidden>:/home/nico:/usr/local/bin/cvssh
- -mrbrocoli:x:60187:65534:Alfredo K. Kojima
<address@hidden>:/home/mrbrocoli:/usr/local/bin/cvssh
- -chunsj:x:60188:65534:Sungjin Chun
<address@hidden>:/home/chunsj:/usr/local/bin/cvssh
[ truncated for brevity ]
+Jonesy:x:62365:65534:Chris Jones
<address@hidden>:/home/Jonesy:/usr/local/bin/cvssh
+JonnyQ:x:62296:65534:Ricardo Sousa
<address@hidden>:/home/JonnyQ:/usr/local/bin/cvssh
+KaRMa:x:61872:65534:Massimo Bilvi
<address@hidden>:/home/KaRMa:/usr/local/bin/cvssh
+Kandjar:x:61740:65534:Cédric Lallain
<address@hidden>:/home/Kandjar:/usr/local/bin/cvssh
+Lahm:x:62776:65534:Lanzani Giuseppe
<address@hidden>:/home/Lahm:/usr/local/bin/cvssh
+Lemming:x:62846:65534:David Westley
<address@hidden>:/home/Lemming:/usr/local/bin/cvssh
+Liz_Dodd:x:61803:65534:Elizabeth Dodd
<address@hidden>:/home/Liz_Dodd:/usr/local/bin/cvssh
[ truncated for brevity ]
- --
Hugo Gayosso
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQE+d+TVMNObVRBZveYRAsBxAJ4yN3ThKGWiFbyN893GD2jCX+k8+wCeNnzT
Wv9OQF3uGyk1eZm2zo+wF7s=
=1w3/
-----END PGP SIGNATURE-----
- [Savannah-hackers] subversions hacked?,
Hugo Gayosso <=