Re: [gentoo-dev] possible trojan in openssh-3.4p1

[Vitaly Kushneriuk <vitaly_kushneriuk@yahoo.com>]

On Thu, 2002-08-01 at 11:37, Rob Kaper wrote:
> Pat, Neil, Gentoo devs, KDE friends:
> 
> >From #kde-freebsd:
> 
> <knu> ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-3.4p1.tar.gz is trojaned
> <tap> nothing on google either
> <knu> steals /etc/passwd to send to a certain IRC network and removes itself
> <Capzilla> knu : says who
> <knu> see the code, but never run make
> <knu> openbsd-compat/{Makefile.in,bf-test.c}
> 
> Looks like some weird stuff is in there indeed.
> 
> md5sum of the binary that appears to be trojaned:
> 
> 3ac9bc346d736b4a51d676faa2a08a57  openssh-3.4p1.tar.gz
> 
> As far as I can see, compiled binaries are *not* affected, but you might
> want to carefully examin this more closely (I'm waiting with upgradepkg en
> emerge on my systems until there's some more info). We've had a few hoaxes
> recently, but this looks suspicious.
> 
> My apologies if this is just a storm in a glass of water.
> 
> Rob
> -- 
> Rob Kaper     | Gimme some love, gimme some skin,
> cap@capsi.com | if we ain't got that then we ain't got much
> www.capsi.com | and we ain't got nothing, nothing! -- "Nothing" by A
> _______________________________________________
> gentoo-dev mailing list
> gentoo-dev@gentoo.org
> http://lists.gentoo.org/mailman/listinfo/gentoo-dev
> 
It's indeed looks like a trojan. It doesn't send you'r etc/passwd tho.
It connects to the 203.62.158.32[web.snsonline.net.] port 6667[irc]
and opens shell session on that connection, so that whoever is in
control there will be able to execute arbitraty commands on your system
with you'r current privileges. especialy dangerouus if you compile as
root.

	/Vitaly.