Re: RedHat compromise

[Jose Nazario <jose () BIOCSERVER BIOC CWRU EDU>]

On Tue, 20 Feb 2001, Johan.Augustsson wrote:

> Telnet!? Are you out of your mind? The intruder might use the cracked
> box as a sniffer and then you try to telnet to it? Use SSH and do not
> use telnet for any other systems in the same physical network as the
> cracked computer.

one overlooked possibility is that if they have root on the box you're on
already, they can easily intercept system calls and reassemble your ssh
stream. in fact, a tool exists to do this: sshsniff. all you need is one
side of the connection, and attach yourself to the process.

____________________________
jose nazario                                                 jose () cwru edu
                     PGP: 89 B0 81 DA 5B FD 7E 00  99 C3 B2 CD 48 A0 07 80
                                       PGP key ID 0xFD37F4E5 (pgp.mit.edu)