Re: breakins

Article View: comp.sys.next.sysadmin

Article #548

Back to comp.sys.next.sysadmin Previous Next

#548

From: Rob Francis
Date: Sun, 12 Apr 1992 05:34

18 lines
1377 bytes

>Here is a phenomenon that one of my users reported to me.  Once, on logging
>in to his system, he saw an alert panel raised in the upper left corner
>of the screen that said "Security Alert: INTRUDER".  Now the funny thing
>is that this machine is not networked and does not even have UUCP enabled.
>There is no getty on the modem line, although the user does dial in to the
>university daily.
>
>Has anyone else seen this panel.  I went looking for it with strings and
>grep, but I haven't found what would put it up.

I've seen this happen before.  It was because someone was messing
around with NetInfo, removing users that were already logged in.  That
user's login doesn't just go away upon the removal of the UID, but it
can make for alert panels when they try to do something that
references NetInfo.

-rob
francisr@indiana.edu

Technical Details

Message-ID: <1992Apr12.053445.17982@bronze.ucs.indiana.edu>

Path: arc1-ca.pugleaf.net!sparky!uunet!usc!sol.ctr.columbia.edu!bronze!camera!francisr

References: <1992Apr10.162220.6992@next.cambridge.ma.us> <1992Apr10.195411.15634@murdoch.acc.Virginia.EDU>

Show Full Headers

Complete Article Headers

Newsgroups: comp.sys.next.sysadmin
Path: arc1-ca.pugleaf.net!sparky!uunet!usc!sol.ctr.columbia.edu!bronze!camera!francisr
From: francisr@camera (Rob Francis)
Subject: Re: breakins
Message-ID: <1992Apr12.053445.17982@bronze.ucs.indiana.edu>
Sender: news@bronze.ucs.indiana.edu (USENET News System)
Nntp-Posting-Host: camera.journalism.indiana.edu
Organization: Indiana University
References: <1992Apr10.162220.6992@next.cambridge.ma.us> <1992Apr10.195411.15634@murdoch.acc.Virginia.EDU>
Date: Sun, 12 Apr 92 05:34:45 GMT
Lines: 18

Reply to Parent Message