OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Ricky Vludmore (ricky2kanonymous.to)
Date: Wed Aug 29 2001 - 03:47:26 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    ('binary' encoding is not supported, stored as-is) I have a SunOS 5.8 system with a printer attached to it (used to service print requests on my company's network). It's a fairly
    busy printer. It's accessible via the Internet, with reason.

    Yesterday I went to investigate why a large batch of jobs had
    frozen. I discovered that they had been erased. Strange
    considering that nobody else has access to this machine and
    I haven't seen it happen before. I snooped around and noticed
    some very strange activity, namely what appeared to be signs
    of an intrusion- idle shell processes and other abnormalities.
    Not thinking, I pulled the plug :-(

    The only indication of an intrusion now is a log file that
    shows someone requesting a print request to or from a
    "KARMAPOLICE" printer/server which I don't recognize at
    all.
        
    Ring any bells?

    ------------------------------------------------------------
    This email was sent through the free email service at http://www.anonymous.to/
    To report abuse, please visit our website and click "Contact Us."

    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management
    and tracking system please see: http://aris.securityfocus.com