Was I hacked?
in [Suse]
|
Prev: Root growing--closure
Next: ath9k in 11.3?
From: Pete Puma on 29 Jun 2010 19:39 Being impatient for the new openSuse release, I decided to check an old hard drive to see if anything valuable was on it and install openSuse RC1 for the interim 15 days. On the root level of the disk (where I had run openSuse 11.1) I see a 0k file named, ?mypassword?, not actually the words: mypassword, but my actual password?the one I use to log in. Sitting there in the open. My jaw dropped. I share this logon with no one. Another 0k file was right under it, named, ?success?. Neither had any data in them. Should I feel as violated as I do? Did someone get me?
From: FatBytestard on 29 Jun 2010 19:51 On Tue, 29 Jun 2010 19:39:47 -0400, Pete Puma <pete(a)puma.org> wrote: >Being impatient for the new openSuse release, I decided to check an old hard >drive to see if anything valuable was on it and install openSuse RC1 for the >interim 15 days. > >On the root level of the disk (where I had run openSuse 11.1) I see a 0k >file named, ?mypassword?, not actually the words: mypassword, but my actual >password?the one I use to log in. Sitting there in the open. My jaw dropped. >I share this logon with no one. >Another 0k file was right under it, named, ?success?. > >Neither had any data in them. Should I feel as violated as I do? > >Did someone get me? Consider yourself gotten. :-)
From: J G Miller on 29 Jun 2010 20:10 On Tue, 29 Jun 2010 19:39:47 -0400, Pete Puma wrote: > Another 0k file was right under it, named, ?success?. Actually called ?success? or just /success I think that a file called /success may get created as part of the boot up sequence in openSUSE related to disk checking and mounting, possibly after a needed fsck of a file system.
From: David Bolt on 29 Jun 2010 20:40 On Wednesday 30 Jun 2010 01:10, while playing with a tin of spray paint, J G Miller painted this mural: > On Tue, 29 Jun 2010 19:39:47 -0400, Pete Puma wrote: > >> Another 0k file was right under it, named, ?success?. > > Actually called ?success? or just /success > > I think that a file called /success may get created > as part of the boot up sequence in openSUSE related to disk > checking and mounting, possibly after a needed fsck of a file system. It's created during shutdown and reboots by the script /etc/init.d/halt and /etc/init.d/reboot , and is normally removed by the boot script /etc/init.d/boot.localfs : davjam(a)moray:~> grep -n -C 2 /success /etc/init.d/* /etc/init.d/boot.localfs-256- # clean up /etc/init.d/boot.localfs-257- # /etc/init.d/boot.localfs:258: rm -f /etc/nologin /nologin /fastboot /forcefsck /success /etc/init.d/boot.localfs-259- rc_status -v -r /etc/init.d/boot.localfs-260- -- /etc/init.d/halt-111- /etc/init.d/halt-112-# set a flag that we had success upto this point /etc/init.d/halt:113:test -w / && > /success /etc/init.d/halt-114- /etc/init.d/halt-115-# give processes in front a chance to quit -- /etc/init.d/reboot-111- /etc/init.d/reboot-112-# set a flag that we had success upto this point /etc/init.d/reboot:113:test -w / && > /success /etc/init.d/reboot-114- /etc/init.d/reboot-115-# give processes in front a chance to quit As you can see, all it is is a flag file. Regards, David Bolt -- Team Acorn: www.distributed.net openSUSE 11.0 32b | | | openSUSE 11.3RC1 32b | openSUSE 11.1 64b | openSUSE 11.2 64b | TOS 4.02 | openSUSE 11.1 PPC | RISC OS 4.02 | RISC OS 3.11
From: David Bolt on 29 Jun 2010 20:51
On Wednesday 30 Jun 2010 00:39, while playing with a tin of spray paint, Pete Puma painted this mural: > Being impatient for the new openSuse release, I decided to check an old hard > drive to see if anything valuable was on it and install openSuse RC1 for the > interim 15 days. > > On the root level of the disk (where I had run openSuse 11.1) I see a 0k > file named, ?mypassword?, not actually the words: mypassword, but my actual > password?the one I use to log in. The only file(s) I've found in my / were /success, which my other reply shows to be a flag file, a /core file which I couldn't give a monkeys about, and /.swap_file which is an emergency swap file for use when I suddenly start needing more swap space than I originally set aside. If an empty file was present with the same name as my password, I would be very interested to know why it was there. Maybe examining /root/.bash_history , or even ~/.bash_history may put some light on the files creation. > Sitting there in the open. My jaw dropped. > I share this logon with no one. > Another 0k file was right under it, named, ?success?. See my other response. > Neither had any data in them. Should I feel as violated as I do? > > Did someone get me? Most unlikely. For starters, unless you've turned off the firewall, that is enabled by default. Most, if not all, services don't listen to the net, so you're going to be pretty well protected. As to _how_ the "mypassword" file was created, as I've never seen such a thing happen on any of my systems, I don't have any idea how it could have appeared. Regards, David Bolt -- Team Acorn: www.distributed.net openSUSE 11.0 32b | | | openSUSE 11.3RC1 32b | openSUSE 11.1 64b | openSUSE 11.2 64b | TOS 4.02 | openSUSE 11.1 PPC | RISC OS 4.02 | RISC OS 3.11 |