[Savannah-hackers] Re: subversions hacked?

[Mathieu Roy]

Hi believe the account added are correct. It's the removed part that
is strange.

Loic fixed something a few days ago about the account
creation. This is maybe related.
What do you think Loic?


Hugo Gayosso <address@hidden> said:

> I guess some of you already saw this message, but I didn't see any
> comments on either system-hackers nor on savannah-hackers, so here it
> is:
> 
> I am truncating parts of the message, in summary a lot if not all of
> the shell accounts in subversions were removed from '/etc/passwd' and
> a bunch of other accounts (suspicious usernames) were created:
> 
> From: address@hidden (subversions's file diff daemon)
> Subject: subversions:/etc/passwd -- recent changes
> To: address@hidden
> Date: Tue, 18 Mar 2003 04:00:20 -0500
> Reply-To: address@hidden
> 
> This is an automated report from subversions.
> Recent changes to /etc/passwd:
> 
>  252 -rw-r--r--    1 root     root       251121 Mar 17 12:26 /etc/passwd
> 
> diff  -u0  /home/diffmon/old_file_dir/subversions:!etc!passwd.gz /etc/passwd
> --- /tmp/diffmon9404  Tue Mar 18 04:00:19 2003
> +++ /etc/passwd       Mon Mar 17 12:26:14 2003
> @@ -36,153 +36,30 @@
> -anoncvs:x:1003:1003:Anony Mouse Read-only CVS 
> User:/home/empty:/usr/local/bin/cvssh
> -michael:x:1004:65534:Michael Hanni 
> <address@hidden>:/home/michael:/usr/local/bin/cvssh
> -jonas:x:1042:65534:Jonas Öberg <address@hidden>:/home/jonas:/bin/bash
> -thomas:x:9107:65534:Thomas Bushnell, BSG 
> <address@hidden>:/home/thomas:/bin/bash
> -kwzh:x:31508:65534:Karl Heuer <address@hidden>:/home/kwzh:/usr/bin/rc
> -mhw:x:31613:65534:Mark H. Weaver <address@hidden>:/home/mhw:/bin/bash
> -alex:x:60001:65534:Alexander Langer 
> <address@hidden>:/home/alex:/usr/local/bin/cvssh
> 
> [ truncated for brevity ]
> 
> +0rfelyus:x:62520:65534:Daniel Skarda 
> <address@hidden>:/home/0rfelyus:/usr/local/bin/cvssh
> +1984:x:60357:65534:M.-A. DARCHE 
> <address@hidden>:/home/1984:/usr/local/bin/cvssh
> +3diff:x:60216:65534:Brian Youmans 
> <address@hidden>:/home/3diff:/usr/local/bin/cvssh
> +AGustan:x:61602:65534:Aurelien Gustan 
> <address@hidden>:/home/AGustan:/usr/local/bin/cvssh
> +AaronM:x:61539:65534:Aaron M. 
> <address@hidden>:/home/AaronM:/usr/local/bin/cvssh
> +AdamFSmith:x:62452:65534:Adam F. Smith 
> <address@hidden>:/home/AdamFSmith:/usr/local/bin/cvssh
> +Agamenon:x:62196:65534:Raul Garita Chacón 
> <address@hidden>:/home/Agamenon:/usr/local/bin/cvssh
> +Aiua:x:63183:65534:Adrien de Sentenac 
> <address@hidden>:/home/Aiua:/usr/local/bin/cvssh
> +AlwaysGoodTimes:x:63188:65534:Zurab Davitiani 
> <address@hidden>:/home/AlwaysGoodTimes:/usr/local/bin/cvssh
> +Ankh:x:62421:65534:Liam Quin <address@hidden>:/home/Ankh:/usr/local/bin/cvssh
> +ArauKo:x:62748:65534:Luis Araujo 
> <address@hidden>:/home/ArauKo:/usr/local/bin/cvssh
> +ArbreVert:x:62743:65534:ArbreVert 
> <address@hidden>:/home/ArbreVert:/usr/local/bin/cvssh
> +Arvoreen:x:63205:65534:Paul Bettinger 
> <address@hidden>:/home/Arvoreen:/usr/local/bin/cvssh
> 
> [ truncated for brevity ]
> 
> -mirko:x:60178:65534:Mirko Viviani 
> <address@hidden>:/home/mirko:/usr/local/bin/cvssh
> -lmiguel:x:60179:65534:Luis Miguel Arteaga Mejía 
> <address@hidden>:/home/lmiguel:/usr/local/bin/cvssh
> -csillag:x:60180:65534:Csillag Kristóf 
> <address@hidden>:/home/csillag:/usr/local/bin/cvssh
> -paulv:x:60181:65534:Paul Visscher <address@hidden>:/home/paulv:/bin/bash
> -srbaker:x:60184:65534:Steven R. Baker 
> <address@hidden>:/home/srbaker:/usr/local/bin/cvssh
> -jagapen:x:60185:65534:Jonathan Gapen 
> <address@hidden>:/home/jagapen:/usr/local/bin/cvssh
> -nico:x:60186:65534:Nicola Pero 
> <address@hidden>:/home/nico:/usr/local/bin/cvssh
> -mrbrocoli:x:60187:65534:Alfredo K. Kojima 
> <address@hidden>:/home/mrbrocoli:/usr/local/bin/cvssh
> -chunsj:x:60188:65534:Sungjin Chun 
> <address@hidden>:/home/chunsj:/usr/local/bin/cvssh
> 
> [ truncated for brevity ]
> 
> +Jonesy:x:62365:65534:Chris Jones 
> <address@hidden>:/home/Jonesy:/usr/local/bin/cvssh
> +JonnyQ:x:62296:65534:Ricardo Sousa 
> <address@hidden>:/home/JonnyQ:/usr/local/bin/cvssh
> +KaRMa:x:61872:65534:Massimo Bilvi 
> <address@hidden>:/home/KaRMa:/usr/local/bin/cvssh
> +Kandjar:x:61740:65534:Cédric Lallain 
> <address@hidden>:/home/Kandjar:/usr/local/bin/cvssh
> +Lahm:x:62776:65534:Lanzani Giuseppe 
> <address@hidden>:/home/Lahm:/usr/local/bin/cvssh
> +Lemming:x:62846:65534:David Westley 
> <address@hidden>:/home/Lemming:/usr/local/bin/cvssh
> +Liz_Dodd:x:61803:65534:Elizabeth Dodd 
> <address@hidden>:/home/Liz_Dodd:/usr/local/bin/cvssh
> 
> [ truncated for brevity ]
> 
> -- 
> Hugo Gayosso
> 
> _______________________________________________
> Savannah-hackers mailing list
> address@hidden
> http://mail.gnu.org/mailman/listinfo/savannah-hackers

-- 
Mathieu Roy
 
 << Profile  << http://savannah.gnu.org/users/yeupou <<
 >> Homepage >> http://yeupou.coleumes.org           >>
 << GPG Key  << http://stock.coleumes.org/gpg        <<