Path: utzoo!mnetor!uunet!mcvax!ukc!its63b!csnjr From: csnjr@its63b.ed.ac.uk (Nick Rothwell) Newsgroups: comp.misc Subject: Re: Trojan Horse a Myth? Message-ID: <843@its63b.ed.ac.uk> Date: 16 Dec 87 13:13:56 GMT References: <459@gtx.com> <405@tardis.cc.umich.edu> <8192@ism780c.UUCP> <1479@osiris.UUCP> Reply-To: nick%lfcs.ed.ac.uk@uk.ac.ucl.cs.nss (Nick Rothwell) Organization: LFCS, University of Edinburgh Lines: 18 Keywords: Even worse with ethernets In article <1479@osiris.UUCP> mjr@osiris.UUCP (Marcus J. Ranum) writes: > Another VAX virus I heard about was a friend of mine who had a system >that would not boot normally no matter what. A disgruntled former employee had >written a program that was spawned really quietly at boot time and would romp >through the process table killing everything except itself as fast as it could. I heard of a similar case, but worse, on a network of SUNs running NFS and Yellow Pages. Someone wrote a program which looked up the names of the other hosts on the net, and then spawned off a "rsh ..." to create a copy of itself on these other machines. It was stopped by powering down every single machine. You can't log in to fix it, of course, because the beast has filled the process tables on every machine... -- Nick Rothwell, Laboratory for Foundations of Computer Science, Edinburgh. nick%lfcs.ed.ac.uk@nss.cs.ucl.ac.uk !mcvax!ukc!lfcs!nick ~~ ~~ ~~ ~~ ~~ ~~ ~~ ~~ ~~ ~~ ~~ ~~ ~~ ~~ ~~ ~~ ~~ ~~ ~~ ~~ "Nothing's forgotten. Nothing is ever forgotten." - Herne