[Savannah-hackers] [gnu.org #134667] Savannah-Server suckit attack

[John Paul Wallington via RT]

address@hidden received the following report:

address@hidden - Thu Dec  4 08:37:33 2003]:

> Dear sir,
> 
> I write you because we have been attacked on one of our linux server
> each beginning of month (near the 2th-4th) of septembre, October and
> November on the same machine. Be careful that not only the suckit is
> installed but also a fake ssh is installed in /usr/local/bin. As I
> could see on our hacked server, I think that no information have been
> modified except the one described here up. We have been attacked
> by a hacked linux firewall of one of our customer which had the root
> passwd of our server.
> 
> For privacy reason, I write you as private user and cannot give you
> detail on which server has been infected. But If you have any
> additional information, I would be interested in.
> 
> Best regards
> 
> Franco Rizzo
> --------------------------------
> Franco Rizzo
> Prélards 33
> CH-2088 Cressier
> +41327571830