I've noticed that most people have jumped to the conclusion that this is
NetBUS or BO. Is it not more reasonable to assume this
is a popup message from the Messenger Service? That's only got an "OK"
button. Note the guy said, "Just wanted to let you know your
computer is hackable" - doesn't say he was hacked and had BO stuck on his
machine. The guy probably saw that NetBIOS based traffic over TCP 139 could
reach the user and the guy went

c:\>net send user-name "bal de blah"

having edited his lmhosts file. Remember - it's a second hand report by the
time it the message got to this list. The user would have left out some
details etc etc....

I think the obvious should be looked at first before sending this guy into a
deep panic.
IMO.
Cheers
David Litchfield



-----Original Message-----
From: Security Administrator <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED] <[EMAIL PROTECTED]>
Date: Friday, January 29, 1999 1:26 AM
Subject: Can you ID the program that did this??


>Hi,
>
>Recently, one of our users reported the following.  I was wondering if
>anyone could identify the program that might have caused it, if it's
>publicly available.
>
>
>A user on our system (using Windows and running ICQ, in case its relevant)
>was going about their work when suddenly a window popped up with the
>message "Message from a friendly hacker.  Just wanted to let you know your
>computer is hackable."  The only button available to push said "OK".  The
>message was in various type styles and fonts.  The window specifically did
>not have a title bar or side bars - it was a simple, blank window.  There
>were also no commercial markings anywhere in or on the window.
>
>
>If you can identify a program that might have done this, I would
>appreciate it immesurably.  As it is, we really don't know what we are up
>against.
>
>
>Thanks very much,
>
>
>Richard Hakim
>
>
>-
>[To unsubscribe, send mail to [EMAIL PROTECTED] with
>"unsubscribe firewalls" in the body of the message.]
>

-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]

Reply via email to