Re: ssh trojaned

[loki_ () softhome net]

Hi,

On Mon, Aug 05, 2002 at 09:02:38AM -0500, Nick Lange wrote:
> From: "Nick Lange" <nicklange () wi rr com>
> To: <vuln-dev () securityfocus com>
> Subject: Re: Re: ssh trojaned
> Date: Mon, 5 Aug 2002 09:02:38 -0500
> X-Mailer: Microsoft Outlook Express 5.50.4807.1700
            ^^^^^^^^^^^^^^^^^^^^^^^^^
            Warning: You are using software from Microsoft.

> or perhaps, if I am mirror A have a watchdog script compare my md5 sum to
> every other md5 sum accross the mirrors, and take some action should the
> ratio of unmatching MD5's falls below a certain percentage...

that would not work because a smart attackor would serve the correct
file and hash to the watchdog scripts, iss.com, and so on and
serve the trojaned file to presumedly unsuspecting victims only.
iirc, the trojaned version of epic was served to specific ip ranges
only.

--loki