Re: [gentoo-dev] possible trojan in openssh-3.4p1

[Terje Kvernes <terjekv@math.uio.no>]

Vitaly Kushneriuk <vitaly_kushneriuk@yahoo.com> writes:

> On Thu, 2002-08-01 at 11:37, Rob Kaper wrote:
>
> > Pat, Neil, Gentoo devs, KDE friends:

  [ ... ]

> > <knu> see the code, but never run make
> > <knu> openbsd-compat/{Makefile.in,bf-test.c}

  hm.  can someone tell me what is up with bf-test.c?  these char
  datas are rather unreadable to me.
 
> > Looks like some weird stuff is in there indeed.
> > 
> > md5sum of the binary that appears to be trojaned:
> > 
> > 3ac9bc346d736b4a51d676faa2a08a57  openssh-3.4p1.tar.gz
> > 
> > As far as I can see, compiled binaries are *not* affected, but you
> > might want to carefully examin this more closely (I'm waiting with
> > upgradepkg en emerge on my systems until there's some more
> > info). We've had a few hoaxes recently, but this looks suspicious.
> > 
> > My apologies if this is just a storm in a glass of water.
>  
> It's indeed looks like a trojan. It doesn't send you'r etc/passwd
> tho.  It connects to the 203.62.158.32[web.snsonline.net.] port
> 6667[irc] and opens shell session on that connection, so that
> whoever is in control there will be able to execute arbitraty
> commands on your system with you'r current privileges. especialy
> dangerouus if you compile as root.

  ick.  can someone confirm this trojan?

-- 
Terje