Re: tlug: Now, ain't this really odd??!!

[Chris Sekiya <chris@example.com>]

(nice to see the TLUG list up again)

On Sat, 29 Aug 1998, Rafael Coninck Teigao wrote:

> I went IRCing for a time that night and, after login-out, I looked at my
> /var/log/secure and found out that somebody was trying to telnet my
> machine...I did the same to his machine, than the odd thing happened: I
> got telneting, yada-yada-yada, but after some text and a screen (like
> those old BBS), my kernel started showing lots of error messages, then
> rebooted (I was as root out of the X); thought that it could be a
> problem on my kernel, after booting I tried telneting again to the same
> host (this time as an unprivileged user, still out of X) and I got the
> same errors, but this time no reboot at the end, just a halted system! 

There should have been no way for you to reboot your machine by telnetting
to another machine.

I'll be willing to bet that the fellow who telnetted to your machine
subsequently attacked it.  Your kernel should have been immune to the Ping
of Death(tm), but it's likely vulnerable to teardrop attacks or the like.

Secure your machine.

-- Chris

--------------------------------------------------------------
Next Nomikai: 18 September, 19:30 Tengu TokyoEkiMae 03-3275-3691
Next Meeting: 10 October, Tokyo Station Yaesu central gate 12:30
--------------------------------------------------------------
Sponsor: PHT, makers of TurboLinux http://www.pht.co.jp