SSH password capture

[Andrew Daviel <advax () TRIUMF CA>]

We recently found trojan openssh programs on a few machines, busy logging 
passwords in and out. I just wondered if anyone else had been hit by 
this, or had the source code - the one we found had a "SKYNET" ascii-art 
logo embedded in it. I suspect it of having a login backdoor, too, but 
can't prove it. I think they had a user account and privilege esclation 
exploit to get started, then followed some root passwords to get more 
systems, but don't seem to have done anything else to draw attention to 
themselves. An MD5 check against the package manager records found them 
once we started looking.

I've been trying to encourage ssh keys instead of passwords, especially 
for root, after being bitten a few years back, but it's hard - passwords 
seem embedded in the modern psyche.

--
Andrew Daviel, TRIUMF, Canada