Re: How could this account have been cracked?

On 2006-09-25, robb@xxxxxxx <robb@xxxxxxx> wrote:
I personally created an account with a somewhat uncommon spelling of a
name. I told no one about this account. I personally only once logged
into it from the console in my private office running KDE in order to
test it. It's possible I gave it a weak password. (I've since
forgotten it.)
Can you clarify on the meaning of 'console'? Do you mean you logged in
to the compromised machine remotely from a box in your office, or do you
mean that you logged into the compromised machine via /its/ console (ie
not remotely)?


Only seven days later, "last" shows someone ssh'ing into the account.
Inspection shows that this person really knew what they were doing -
attempting to install a rootkit, setting up a spam process, etc.
Arguably, that sounds like there was no 'person' involved, just an ssh
bot.

--
Ian Kilgore
echo "pfxz@xxxxxxxx" | tr pzfwxt ikagno
.

Relevant Pages