HUG 16 98 HCIS EREG BSHQ 884 445-2982 P 15 77 73 A1010 l z cb 019 1 29 if Report Date 10 Oct 96 Name Common ous Phone COMM Phone USN E-Mail red Mines EDU Type 1 report 0 Suspect IP Victim IP - Port Service telnet port 23 sendmail Incident Date 0'7 Oct 96 4 NCIS Case Case Status closed 3w Notes From-rock Mines EDUThu Oct 10 15 54 54 1996 Date Thu 10 Oct 1996 13 22 50 -osoo From Werockmines sum To navcirtafiwcm mil Subject baby_doe minee edu probes Hi Folks - Well barf it looks like 1w message was truncated So I ll try again We have a system here baby doe mines edu_ that had root compromised and went on a search mission for other systems We've gotten several responses from those that were probed for potential entry points and I'm sure that you've seen some of those or will be contacted by others about them The probes occurred between on 10 7 96 and 6 30am MDT on 10 8 96 The lair has been tracked down and we have the logs software and target names of the probe It looks like it mostly probed for the following SMTP - vrfy guest decode bbs 1p decode uudecode majordom 0 enter debug wiz FTP availability RPC ypeerv mount name boot selec rexd rusers ypupdated rstatd ypbind keyserv cgi NFS mounts POPPER It mostly looked like it was looking for entries rather than exploitin 9 them at this time We have tried to cleanse the machine but are uneu re Page 1 20 26 mu sci lu-l cH EREG BSHQ 834 445-2932 P-15 A1010 1 how they got in We do know that they replaced login netstat ifconf is and ps once they were in We are currently filtering packets destined for that machine and a cohort machine from the the Internet Hopefully this will put a bandaid on everything until we can deal with it It appears that the breakin came from ac uk We have some droppings pointing at this - an log for a non-existent user I am including a mail message from who is doing most of the scouting around for evidence In add tion I am including the list of sites that were probed The names look lik security people to us some mail list since several of the targeted people were those who actually sent mail to us saying that they were robed We intend to send a message to all those on the list saying that their site was on the list In addition we can if you think advisable send th a result of the probe We would welcome any advice that you would like to send our way In addition if we can help you please let us know how Thanks - Mail message from spromwbasuauinasenu Wed Oct 9 15 11 53 1995 Date Oct 1996 15 06 58 0600 From basalt Mines EDU Messag - 1 4696basalt Mines EDU To slate Mines EDU Cc slate Mines EDU Sub acker Reply-To -33 late Mines There is a core fi e in t'at was durped during the hack on In it there appears t following name -acyberepace org I fingered same and he happened to be logged on at that moment 143 53 38 51 Page 2 Hue 4 81 sci NLIE EREG BSHQ BB4 445-2982 P 17 A1010 1 I did an nslookup on the latter and it was which is the site that showed up as an just prior to the building of the nest and captured in the hacked login's logfile dst as several logins during the heck - I think this is our hacker details begin baby_doe% vsr spool mqueue baby doe% ls -l core 1 root 8507824 Oct 7 20 40 core slate156 finger slanlecyberspace org cyberspace org Login slanl Name Directory AIM Shell cs On since Wed 6 46 EST on ttqu from 143 53 38 51 No unread mail Nb Plan slateiso nsleo 143 53 33 51 c Name ac uk Address fqlti' slate164 nslookup cyberspace cqm Name Addresm 0n bshy_doe strings var spool mqueue core' ends with FWD was the eat baby doe mines edn mines edn sendamsil alenl cyberspace org 14m PWDI usr include rpc scsn USER Page 3 RUG 18 98 HCIS EREG 884 445-2982 P 1B 31010 1 nfo sendmail and The list of targeted sites bnx co uk -qm ari com imng fr @nwu edu 12485666nortel co uk bur co uk jet msk su 1uxor i n-barl in de RUS Uni Stuttgart DE rus uni-stuttgart de amgengate amgen com uqvax cc uq oz au ramatein-wpc af mi1 -@gazeta pl BIPSCIEDU Gdaahaw com nice ch CuBtServEngalucky csd 591 com cs shaf ac uk It -BPSUVM PSU EDU noc ca ruu nl r01ba ntc nokia cam wi laidenuniv nl cnes r deinci usaak ca amtp cam ac uk damtp cam ac uk Page 4 23' 1 33 1a asam EREG 35m 884 445-2982 A1010 1 fuw adu p1 Bisltd insignia com cairo au dionysos mi fi its csiro au iegate mitre org rua uni-atuttgart de pimacc pima edu cern ch imag fr MAI LER-DWONGNOAA GOV MAILERBBGUVMS BGU AC IL freh-02 adpc purdue edu jfrank com deahaw cam Corp Sun COM corp sun com eng sun cam I eng aun com Misty cam anu edu au @cl cam ac uk oti com eng sun com csc fi hsc fr net' Gkaltia frmug fr net con @3print sprint com Colorado n u colorado edn ita gu edu au aol com Page 5 P 19 nut 4 21 M315 EREG BSHQ 854 445-2982 A1010 1 runit sintaf no @ccmail us dell com ecs Baton ac uk Mail UTexas EDU Gloria r can colorado edu on colorado edu @vt edu ews raicrosof com SMTP who de 110 ntua 1110 no Impstart- com Vic cc purdue edu bwh harvard edu @homeport org math tau ac Ll mickey avid com sandal com procyon com 5 Symbiosis AHP Com anbioais ahp can idemet doe state in us hm de boytov cad sgi com ch aj 1c waterloo on ca zlon aja com hive ee sine edu cableol net ezo ezlink com manawatu planet org nz mid net chat carleton ca Page 6 P 23 RUG 15 98 lama-m NCIS EREG BSHQ 894 445-2982 anubis network com com andy a 1t we June edu madden ca hm edu poling jhu edu bigdog red net uwa ac uk mina du basis com wares not gargan mti 591 com 02 an iacs UI-ID EDU S CAM AC UK @inf ethz ch Gain kaist ac kr reseauml A1010 l chewy wookio net _mersinet co uk 640 lorien ocf gov natmaine com primua COM ca albany edu cs albany edu tia com - eckrnan uiuc edu ph meter beckman uiuc edu -1imit110 com -umbc adu @alydar card 93 com grymoira crd gs com grymo ire ge com racmcom haven boaton ma us Penmmcam vcoamos kaiat ac kr std sbi cam Page 7 P 21 H06 16 56 NCIS EREG 864 445-2982 0 morgan com Fconnect com au 6 iSTy larc nasa gov nisty larc nasa gov csugrad ca vt edu t rgni iel reaudox net -cybercom net cyberspape net net com 0 AU ' awadi com au awadi cqm au iai edu z-asa cam obbes dtcc edu Sunix wor1dcom com sctc com -- ian usc edu ph cdalta eecs nwu edu boutell cqm tcpsun wast sun com Hrilas graatcircle com 7raa1 com real com 3ccsi com Otta cam @cse ucac edu jhn edu 'saturn net wimaey cam atuxing ucdavia edu -urf1unk com rcybarflunk semaphore com 'cafa kaist ac kr -62600 cqm owner fc net flefty novasya um Icica es rochester edu A1010 1 'uasenterprise async vt edu bitb1t reant cornell edu Lb 2a nuu in a l -lih NCLS ERLG BSHO 864 445-2982 A1010 1 Glahman cqm sharkl kylmedia fi Holland Sun COM fwi uva n1 wi uva nl holland Sun COM holland sun cam Starbaae NeoSoft COM anjura com uc1 ac uk al net 850133-1110 upm es cclabs missouri edu evarest cclabs misaouri e u agiz phlab missouri edu bath ac uk guzecdcnet uniandes adu co gaugs ELEE Ca1Poly EDU gauss ELEE CalPoly EDU gauas elee calpoly edu aurrey ac uk lummapaxc com lum sparc com CGM CRIMELAB rivers dra hmg gb tampico cso uiuc edu summit novell cum loigah kei com shadow net shadow nat Subject Ccling gu se Page 9 Hr 54c 33 Hue 1 1 or luild NCIS EREG BSHQ 884 445-2982 P 24 igpw312 plk ef mil ppwelz plk af mil vorandx cs ohiou edu com 'olipperqcb ett com at net r- itchy inner net f- itchy inner net ministry of-love inner net tecnet1 lote jce mil meth peu edu 3 student uq edu au gov bo ca 00 net eerie-ton ca 0 tanford EDU t th ee elantec com 546 AC UK -ozonline com on pluto ulcc ac uk -berserkly Grey com - - ki 11erbee jar naee gov den com pesteur fr miriworld its unimelb EDU AU protocol iisc emet in one nat Sandie gov teleport oomaeege cc r1 ac ukZzz TELEPORT COM esi oom au Bfgh oz eu kaohine jetce e org tis oom tie oom wenda ph1 pond oom eaoepo com @andrew cmu edu Page 10 HUL Itl 133139 NCIS EREG ISHQJ 834 445-2982 irc umbc edu ahorn fr cogs suax ac uk phoenix Princetan EDU et ibm com cs barkeley edu 900 physics usyd edu au pacstar cam au MD NET pro on cham yale edu Bcarleton edu telecom ksu edu CTD ORNL GOV 6zssat dassault-at fr 'bconncx net city ac uk paris eng utsa edu ica harvard e u artarus uwa edu an cconga super unam mx cs ucdawis edu Ebigcat misaouri e u cac washington edu nts gaac com 1saa-cons co uk ccwf cc utexas edu alphasun anu edu au ua oracle cqm 'ztscapa cam 'amtp-gwuspawar navy mil i nl wparanoia cam saranoia com louie ude1 edu recycle cebaf g v oxygen house gov auburn edu goodall goodall cam seaa smu adu seaa amu edu comco com graphita comco cam 'charlia kau kau edn 13 DHL COM A1010 1 phoanix Princeton EDU - up Page 11 P 25 35 HUG 13 58 133149 NCIS EREG BSHQ 834 445-2932 A1010 1 garrison inatcan net src honeywell com blackbird mitre org caenuuiowa edu n5598 lna cornell e u 1n361 tn cornell edu unlich edu tnt microimages ccm pandora mit cau edu au eehcst com andromeda rutgers edn bu adu ca ubc ca oc cs ruu n1 suned1 Nswses Navy Mil rm t ed u Garisto tau ac i1 tbd ord com tbd180 tbd ford com 540 clupine org 1upine org - -power net Intht net ucar e u cs Berkelay EDU Ocs berkeley adu netcocham 'clipper ena fr maridian-data com superior net phoenix net u aricaaon se nat '0a11 net Page 12 13 25 211 Hut 121 58 18 16am NCIS EREG BSHQ 834 445-2982 3 27 A1010 1 mukay convex cam cvanlt is gs com 7155 1oral com owgmail endicott ihm com manna gafc nasa gov rams c1ark nat emics cam znanoat mz hr espresso cs Eerkeley EDU espresso CS Berkeley EDU gv 55i1 cam atud ca uit no shalgtt ota utexas edu sysadmin com au cateammcam ailtrhin damon co uk wicked neato org 1391 any dhio-atata edu techunix technion ac il day-systems com aircam cam - Page 13 337% nu no at 163179 NCIS EREG 884 445-2982 I I A1010 1 bose cam MIT EDU bga cam mit edu cc al com student math hr ea mince ugcs ca1tach edu Bluey redars ca Boeing COM nes bu edu rapczao ed ray cam 'appx com ims advantia cam ardot net uca ubc ca avian org Bhronze lcs mit edu drao nrc ca oodr slip natcom com max tiac net columbia edu watsun cc columbia edu Bnovatel ca rhein neckar netsurf de robertecs YALE EDU algebra com iifeak swan ac uk 'panix cam org Page 14 55 an u on nu tutu t d UJ LUU4J A1010 l acidtrip alaaka adu uwe ac uk cs vu n1 rgatekeeper ddp state me us personal-media co jp anl cse au edu 1ux levelh unisa edu au jenrode n1 cbca org solucorp qp ca aesisys cam 1irmm fr snatcom com 3 - com 1- tVscom phiber pryam cam udilbert multiverse cqm mii 1u 1v netherlanda ypai mi ua wolverine hq cic net vtaer cc vt edu yingfox cam dickory SDSU Edu 40 'accmail ceic go cn - Enetcam com 'sg fp cibc cam nr-tech cit cornell edu bbn cam ben com -iamlnet rcd toronto edu 'pafosul hq a mil onegold chem hawaii edu 'dpw cqm dpw cam cordant cqm sour sw oz au suedn aw oz au 'gsm501 a1cata1 cum au gam301 alcatel oz au dimnnsianal cum 'mmp cam panix com rblue weeg uiowa adu Com Page 15 R29 u 'Bd Lu 1an NLL Late tuuq 443-398d P 38 31010 1 rsrd bt co uk 61cs forth gr Tadpole COM Tadpole CQM tealifornia sandia gov rmath psu edu @akamai aps mot cam I mrc lmb cam ac uk Eusrucam iaoils umn adu emericantv com 'inorganic5 chem ufl edu 'inorganic5 dt net Gmuikku jmp fi iona ie iona ie ten Atinc c0M krytan atinc com ilatu edu 10 H- u ai mit edn - telecam kau edn @5tudanta si fct un1 pt melegant cqm ersamarigold eeca nwu edu concorde com cua bc ca iclaco com helix0 chem iastate edu ienavigiat com thepoint cqm 9 lfa oda gu1fnet kw hillnet com natsya com CHeuriaticrat C0M ctc com ita jpl nasa gov dee retix cam mdg com 'earth bcc ml com aaec haneywell cam -Osamba cnb uam ea v eli sc' darwin tachnat sg pobox org ag rst org ag F Page 16 no mu no 70 Hui LUDHUJ 1 31 A1010 1 msdar cam mrnet arbornet org poly phya cwru edu rraman bgu ac il rjeevea ucsd adn borlas cam fadirect com -ta sier cv nrao adn inus mibre org 1inns mitre org ahhgo com - -ucse cse nau edn nbs na u edu cpine cse nau edu emit a u phy ucaf edu 'ca bgsu e u yiq net netscape com cheetah llnl gov Csoften ktu 1t Sylvan cau Gaylvan com 1 0 COM - Bphibro com A idga 6dm 'iais st 3cam com czeus ST 3Cam COM -entropic cam iihs com fc nat inistry paranoia cam paxanoia cam ac nyc ny us Mail Coaat NET igarnet msen cam - ulian uwo ca cc empath on ca gnn ai mit e u sneeza resp sci arizana edu camal ncal nist gcv a1pha dcs mph uniba sk umich egu NDA COM ndmcom Page 17 Lu mum-m 191 LKLL war-1w mum 4 43-53 34 31010 1 thepoint com dircon co uk unbc Ca alfa ist ut1 pt tsable ox ac uk Fucssun1 sdsu edn oma crimelab cam tidtest tota1 r 'tidtent total fr onshore com c- tac com intac cam yeagar ccrp sgi com natspace org infoseek com 'netscape cam i'alphejpmorgan com tsys cam payber com ert d n dn - bb vampira fisons cam @ragnarok hks cam ra1 randomc ccm Gnetworking atanford edu a b cpr 1tg telecommcom au Gdandalion cam marcus its rpi edu norrow CS Yala EDU dbs informatik uni muenchen de singnet com sg charlia ccd bn1 gov ique apm orn1 gov cart org msdia mit e u etcam cam 'netbistro com cdb ohio state edu net ohio-stata edn path net ultra aca ohio-state adu -pattyr aca ohio-state edu pattyr acs ohio-state edu netcom com Page 18 us Hub 10 '53 1m de HCIS BSHQ 834 445-2982 A1010 l -dumbcat sf cams dumbcat s ca us micromuaa co uk redhat cam tky icdc fr tky icdc fr il7linnxb ista pwr wroc pl l columbia edu netsya cam qtac edu au ftipper oit unc edu Ezang com anng kcc hawaii edu zang kcc hawaii edu internic net Gaol nst1 gov tele nokia fi suaton ida ing tu bs de Emailhost emap co uk paaton co uk V'arca md com rapex ca cs au oz au 'qpcammca ott cpcom ca etaff cs su oz au uta edu au uts adn au wor1d1inx com r1 Insisealaliden edu am agate com aaka net 2 asledu -gac edu ugca caltach odu mavarick intecom com cci umdnho pt nawc so chinalake navy mi1 -a tarport net o cam aqwast bc ca EnGarde c6m c3sarve c3 1an1 gov angards cam argus cu-an1ine om typhoon-ethnr Barkcley EDU 'ca purdua edu vodka saa att cam vodka sse att com rnetrai1 net 'usa net Page 19 38 53 33 Lt3 I-H-I t l mac-d 5 infoaoc com fit qut edu au etc nato int mit edu 3tacnet com boytoy cad sgi com contract kent edu eanquco il finlink cam networx ia affetyeil u5 swiaabank cam 'village cam pobox upenn edu _ summit novell ccm cica ea ubic COM a pha dcs mph uniba sk Scorp cirrus com oz com doc ic aa uk 'sophoa cqm c1grk net rggr co uk an com l-arsc adu gabux1 uchicago edu pa dec cqm partner itdanr1 navy mil science gmu edu 1W0 ed io atlantic net u1crum cum au -mamn mu oz xU -mama mu oz au nai edu Page 20 uv'l nul n 4 than LDOHJ LL 15 HR hm ya '45 iu'cDH'l Hum mu 10wa A1010 1 tachoolnet car1eton ca amhnx3 amherat edu ifuture incog cam fvividanewbridge cam i mamorysaleadirect com umdt edu ari cam - 'vis colostate edu longematerials oxford ac uk Glagless demnn co uk flagleaa demon co uk Gstarqata acs lamp ac uk -@en com 'cr1 cam rucad edu rift NET ralohamet Falohamet ruhnnix uhcc Hawaii Edu fuhnnix uhcc hawaii edu wiliki enqahawaii edu rzang kcc hawaii edu rzang kcc hawaii edu zeta arg au - org au @mcs an1 gov @mcs an1 gov 'solar sky net teater randamc com galaxy csc calpoly e u ' statler cac calpoly edu istatlar csc calpoly edu ksaw rutgers edn c2 org -riowcam utirc utoronto ca -u londnn micrognoaia com ilondonmicrognosia quack kfu com tlug rept11es org rcoewl can uiuc edu monad awb de 3cu31 ctstateu edu xylan cum bwner-bugtraq digest Page 21 Plas t4 mm I owner bugtraq digaatafc net was ta org c ac uk com com adsu edu pagasus mtgers edu lemma usach c1 11 1133 131 usac admin id net netcom com mission com W0 WOLFE net CERF NET dartmouth edu integer leis loral com idiomOUCS ox AC UK foo cues ox ac uk 6951313 ox ac 3331 COM videologic com 3-37 math tu-berlin de oes amdahl com can amdahl com 1e11man com eckard edu ilkent adv tr we 1 ads-c 2555 A1010 1 Page 22 P 36 Luz LRLO wanna mum 443-436 Int ampn s co uk usa nat phnenix sas muohio edu 7HUOhio Edu -s bu alo edu achillaa net 5dragon achilles net isemaphora cam gm c0m econ 3erkalay EDU AZStarNet com uburbia qpana org au suburbia net hpopbl carn ch 'ockwave COM abradley bradley edu - 7rea0805 wins icl co uk ae mu oz au auckland ac nz on ll rhi hi ia 3rhi hi is ultra acs ohio-state edn mc5 an1 gov tavor openu ac il hri com internex net research qanan cam au annd noaa gov amoco com mail coin miasouri edu bani cam ca ision cum campulink gr 2600 cum taz nceye nat ammumd e u imsi com imai com A1010 1 Page 23 lob Pi u a a -1 --Io-Il luv-u ham shun-1 amt-Pr at I A1010 1 jeeves not ARL MIL com btg com s chryaler com cygnua arc nasa gov cygnus arc nasa gov _oozp netcommnet uk owl wsc mass edu paris intertv com fa3 rustmet sfu ca hq of mil mac edu mac cornall edu mail IConNet COM '1 ioonne c com 5 mth Princeton EDU n1 -3brasaap n1 1 iaahv n1 teleport com bluisa ibp IConNat COM iconnet com guard tansu com au holonet net holonat 119 ion mc xerox com indis ion uni-harm do scholar cologne de dobolev rhein do next com au Hpacv COM 132 SWAN AC UK alspOJ hor brad ac uk badgers demon co beast org crimson cndvision corn crimson cadvision corn crimelab corn cdmwab com -86 duth gr merica com iifeak swan ac uk -iifeak swan ac Id Page 24 dad du au-uor-uc A '1 i mmp com p1aton ee duth gr santinet damon co uk cs umb adu nl tarazed usc edn pamd cig mpt com pamd cig mot com ox ac uk ccaip rutgers edu bimaca BITNET syallara cs rmit edu au nmn CGM fnma com Blacthgic Com sug org - c2 org math ethz ch SGT COM mardor ind Wpi edu itesec enata fr galapagos csa psu edu groucho cse psu edu newhackcity net sdc cam au patriot nat sewp nasa gov un kiav ua diaclosura com Lloc3 tandem cam loc3 tandem com plexus com okknr dgxter mi us 'sparta sjsu edu lig net ragiin a mil sec de ncub1 polito it nicotine erols cqm -soscorp com 6641 4 43-4 33 A1010 l Ho Page 25 HEB n quln rqabrie1 reaudax net Fcitec qld gov au cam ov com 'foobar cam foobar com march co uk ringania cam fecat csuchico edu croaslink net 'tembel org tembel org dis org merde dis org merde dia org sci uminho pt actc com I 1' a I 1 114 tcp co uk isco com cs ucdavis edu rearch att cam powerdoq om adem cam Facademmcam qu1 wl aec1 ca eecs umich edu Gnoc ana net 'dilbart redhat com Fredhat com acumn cict fr ca purdue edu cs purdue edu rj51 ccm vx com 1lnl gov ncs com sysl ic ncs com requeaky free org argon ch toolsl ee iaatate edu 1viati kiev ua cee hw ac uk c1m rncgill ca ecf toronto edu n-4 hgnua sabwa ww9 soc 31010 1 Page 26 H 431 uh 4 9 u o -a hulk-tol- u-an-JI bun NJ Ovl'ltl L004 In 31010 1 enel u algary ca networx com - su kau edu 'hy ra aca uci edu cu cnext cso uiuc edu zippyupsc edu 'support mayfield hp com r -Zzy do eunet de ifuzzy do eunet de 'rsgu ae agauagil gsu edu r313 com Chomer bua miami edu Gmatha au oz au @microaoft cam dai unimi it @panacea library ucsb e u rugcs caltech edu adsc edu io orq cwr uwa edu au racceaadig exmet '7 a iaianet cam online no cs columbia adu talapprt cag Racarx msa jhu edu inostramo eeap cwru edu fakira corp agi cam tkevana com fbull damon co uk vmark com 1an nac cam itchy serv net rgoriz sendanet es 'fit qut edu au cogs auax ac uk - 'pafosu1 hq af mil 6 at org gnu ai mit edu atrayliqht connectnet cam arvidajaur anu edu au camp brad ac uk mammoth poatech ac kr -box com unr- Page 27 tdr com xyplax cam 'stud ca uit no vampire sciencelgmu edu rmalpar eaya co m 3'41 SI a - i rmra com cwh bayer com aok5 3e csc i -l gov lahamusenancsa caa nau edu shamusepina cse nau edu versu ac ru Pafu ca isfu ca w cc utexas edn arc xerox cam rarealmcefrieldt 'bast com ee lb1 gov A1010 1 tercom no idsi unimi it aph umich edu -uminho pt @erols com rdruggiat gg caltech edu' druggist gg ca1tech edu andronix org Ufedax cqm 1v426 cc purdue edu 3fedex com kerby ocsg com - af mil -ed ub8 ox ac uk swara com hopi dtcc edn igger itc virginia edu had uta com wzv win tue n1 thv win tue n1 'aol aca uwoah edu 'rpi edu -u- pau edu ncar ucar edu ecaa rpi edu acaa rpi edu altair caustan edu i reenet carleton ca Page 28 4 0- a-1rul Flu-4 RUJHQU ua-H ado-cm 5% P 43 RUG 18 93 163359 NCIS EREG 8I4 445 2982 5 i 31010 1 3-7--ubimca ca biu ac il nos uc-algary ca i1 chevron com - - mozart lahabra chevron com crime lab ctimelab -com poppy kaist ac kr tnet org miranda uwaterloo ca mfinity Lvdev qom Page 29