Path: utzoo!attcan!uunet!husc6!mailrus!purdue!decwrl!ucbvax!ATHENA.MIT.EDU!eichin
From: eichin@ATHENA.MIT.EDU (Mark W. Eichin)
Newsgroups: comp.protocols.tcp-ip
Subject: Re: Crackers and Worms
Message-ID: <8811170500.AA00788@KREMVAX.MIT.EDU>
Date: 17 Nov 88 05:00:05 GMT
Sender: daemon@ucbvax.BERKELEY.EDU
Organization: The Internet
Lines: 25

>Date: 13 Nov 88 23:24:04 GMT
>From: elsie!ado@cvl.umd.edu  (Arthur David Olson)
>> I'll bet the KGB are laughing their asses off.
>That depends on whether kremvax was running 4.3BSD or Ultrix.
% bindtest
> hkremvax.mit.edu
res_mkquery(0, kremvax.mit.edu, 1, 13)
QUESTIONS:
        KREMVAX.MIT.EDU, type = HINFO, class = IN
ANSWERS:
        KREMVAX.MIT.EDU
        type = HINFO, class = IN, ttl = 21600, dlen = 16
        CPU=VAXSTATION
        OS=UNIX
> 

Actually, it is a VS2000, running 4.3BSD+NFS (MIT Project Athena
modifications...) It was not infected (in fact, I used it throughout
the infection, on the MIT decompiling team.)

				Mark Eichin
			<eichin@athena.mit.edu>
		SIPB Member & Project Athena ``Watchmaker'' 

ps. Yes, I chose the name just to be able to answer such a question. :-)