Skip to Content.
Sympa Menu

sm-grimoire - Re: [SM-Grimoire]OpenSSH trojan....

sm-grimoire AT lists.ibiblio.org

Subject: Discussion of Spells and Grimoire items

List archive

Chronological Thread  
  • From: Robin Cook <rcook AT wyrms.net>
  • To: "Sergey A. Lipnevich" <sergeyli AT pisem.net>
  • Cc: SourceMage Grimoire <sm-grimoire AT lists.ibiblio.org>
  • Subject: Re: [SM-Grimoire]OpenSSH trojan....
  • Date: Fri, 02 Aug 2002 07:43:27 -0500

I have not see where it says what exactly this trojan does to the system besides trying to contact a certain IP address and port.

What does else does it do?

Sergey A. Lipnevich wrote:
It was compromised on July 30-31, so if 'gaze installed | grep openssh' tells you that you installed it before these dates, do nothing -- you are safe. If it shows you 2002073{0|1}, do nothing still -- you're compromised and the only true dao out of this is through complete wipe out ;-). Unless you're the one who trojaned poor thing...
The spell has correct MD5 btw.

Robin Cook wrote:

Do all we need to do is recast this once a clean version is posted or do we need to do something with the spell itself?

CuZnDragon
Robin Cook











Archive powered by MHonArc 2.6.24.

Top of Page