143
edits
The Pumpkin Incident: Difference between revisions
m
no edit summary
No edit summary |
mNo edit summary |
||
| Line 19: | Line 19: | ||
From "last pumpkin". | From "last pumpkin". | ||
pumpkin ftp 194.145.134.224 Wed Jan 5 02:34 - 03:10 (00:35) | pumpkin ftp 194.145.134.224 Wed Jan 5 02:34 - 03:10 (00:35) | ||
pumpkin ttyp0 cao.link.hea.net Wed Jan 5 02:18 - 03:09 (00:50) | pumpkin ttyp0 cao.link.hea.net Wed Jan 5 02:18 - 03:09 (00:50) | ||
pumpkin ttyp3 cao.link.hea.net Wed Jan 5 00:43 - 00:59 (00:15) | pumpkin ttyp3 cao.link.hea.net Wed Jan 5 00:43 - 00:59 (00:15) | ||
pumpkin ftp 194.145.134.242 Tue Jan 4 22:46 - 23:02 (00:15) | pumpkin ftp 194.145.134.242 Tue Jan 4 22:46 - 23:02 (00:15) | ||
pumpkin ftp 194.145.130.147 Tue Jan 4 22:44 - 23:00 (00:16) | pumpkin ftp 194.145.130.147 Tue Jan 4 22:44 - 23:00 (00:16) | ||
pumpkin ttyp3 194.145.130.147 Tue Jan 4 22:30 - 23:14 (00:43) | pumpkin ttyp3 194.145.130.147 Tue Jan 4 22:30 - 23:14 (00:43) | ||
pumpkin ttyp9 194.145.134.242 Tue Jan 4 22:09 - 23:19 (01:09) | pumpkin ttyp9 194.145.134.242 Tue Jan 4 22:09 - 23:19 (01:09) | ||
pumpkin ttyp3 194.145.130.147 Tue Jan 4 22:08 - 22:30 (00:22) | pumpkin ttyp3 194.145.130.147 Tue Jan 4 22:08 - 22:30 (00:22) | ||
From auth.log. | From auth.log. | ||
Jan 4 22:08:08 enigma login: login from airlock147.esatclear.ie on ttyp3 as pumpkin | Jan 4 22:08:08 enigma login: login from airlock147.esatclear.ie on ttyp3 as pumpkin | ||
Jan 4 22:09:52 enigma login: login from e-airlock242.esatclear.ie on ttyp9 as pumpkin | Jan 4 22:09:52 enigma login: login from e-airlock242.esatclear.ie on ttyp9 as pumpkin | ||
Jan 4 22:30:56 enigma login: login from airlock147.esatclear.ie on ttyp3 as pumpkin | Jan 4 22:30:56 enigma login: login from airlock147.esatclear.ie on ttyp3 as pumpkin | ||
Jan 5 00:43:50 enigma login: login from cao.link.hea.net on ttyp3 as pumpkin | Jan 5 00:43:50 enigma login: login from cao.link.hea.net on ttyp3 as pumpkin | ||
Jan 5 02:18:50 enigma login: login from cao.link.hea.net on ttyp0 as pumpkin | Jan 5 02:18:50 enigma login: login from cao.link.hea.net on ttyp0 as pumpkin | ||
I won't go into every detail, and I don't know every detail, but Jerry saw Pumpkin logged | I won't go into every detail, and I don't know every detail, but Jerry saw Pumpkin logged | ||
| Line 39: | Line 51: | ||
pumpkin p3 cao.link.hea.net 12:43AM - showmount 127.0.0.1 | pumpkin p3 cao.link.hea.net 12:43AM - showmount 127.0.0.1 | ||
pumpkin p0 cao.link.hea.net 2:18AM - rpcinfo -p www.leet.com | pumpkin p0 cao.link.hea.net 2:18AM - rpcinfo -p www.leet.com | ||
pumpkin 96591 0.0 0.2 1096 812 ?? Is 2:34AM 0:00.10 ftpd: e-airlock224.esatclear.ie: ...-> | pumpkin 96591 0.0 0.2 1096 812 ?? Is 2:34AM 0:00.10 ftpd: e-airlock224.esatclear.ie: ...-> | ||
pumpkin: LIST\r\n (ftpd) | pumpkin: LIST\r\n (ftpd) | ||
pumpkin 96591 0.0 0.2 1096 812 ?? Ss 2:34AM 0:00.15 ftpd: e-airlock224.esatclear.ie: ...-> | pumpkin 96591 0.0 0.2 1096 812 ?? Ss 2:34AM 0:00.15 ftpd: e-airlock224.esatclear.ie: ...-> | ||
pumpkin: STOR VeteScan-12-26-99.tar.gz\r\n (ftpd) | pumpkin: STOR VeteScan-12-26-99.tar.gz\r\n (ftpd) | ||
He had a hunch it was some dodgy cracker kind, and noticed the Irish IP, so went to | He had a hunch it was some dodgy cracker kind, and noticed the Irish IP, so went to | ||