Skip to Content.
Sympa Menu

sm-grimoire - Re: [SM-Grimoire]OpenSSH trojan....

sm-grimoire AT lists.ibiblio.org

Subject: Discussion of Spells and Grimoire items

List archive

Chronological Thread  
  • From: Casey Harkins <charkins AT upl.cs.wisc.edu>
  • To: Robin <robin AT kallisti.2y.net>
  • Cc: "Sergey A. Lipnevich" <sergeyli AT pisem.net>, sm-grimoire AT lists.ibiblio.org
  • Subject: Re: [SM-Grimoire]OpenSSH trojan....
  • Date: Fri, 2 Aug 2002 16:23:02 -0500 (CDT)

Aren't MD5's supposed to be of the tar file and not the gzipped file?

-casey


On Fri, 2 Aug 2002, Robin wrote:

> On Fri, Aug 02, 2002 at 12:30:16AM -0400, Sergey A. Lipnevich wrote:
> > It was compromised on July 30-31, so if 'gaze installed | grep openssh'
> > tells you that you installed it before these dates, do nothing -- you
> > are safe. If it shows you 2002073{0|1}, do nothing still -- you're
> > compromised and the only true dao out of this is through complete wipe
> > out ;-). Unless you're the one who trojaned poor thing...
> Not necessarily true if this is true:
> > The spell has correct MD5 btw.
>
> robin@kallisti:~$ md5sum /var/spool/sorcery/openssh-3.4p1.tar.gz
> 459c1d0262e939d6432f193c7a4ba8a8
> /var/spool/sorcery/openssh-3.4p1.tar.gz
> robin@kallisti:~$ gaze installed | grep openssh
> openssh:20020731:installed:3.4p1
> robin@kallisti:~$ cat /var/lib/sorcery/grimoire/crypto/openssh/DETAILS|grep
> MD5
> MD5=459c1d0262e939d6432f193c7a4ba8a8
>
>
> --
> Robin <robin AT kallisti.2y.net> JabberID: <eythian AT jabber.org>
>
> Hostes alienigeni me abduxerunt. Qui annus est?
>
> PGP Key 0x768B8765 Fingerprint=33C8 EA9C 61F1 F117 EEED 24A5 3BCE 4F77 768B
> 8765
>





Archive powered by MHonArc 2.6.24.

Top of Page