At 1:15 PM +0800 9/7/02, Shay Telfer wrote:
>Reading some subsequent followups, one poster indicates a hacker
would need to know the root password for your Mac to hack into it,
which if true means this may not be as major a problem as first
publicised.
" you have to have root first folks
The very first step in the exploit requires you to use the 'sudo'
command which means you have to have an administrator or root account
on the machine before you can do this. If you have root access you
can already do anything you want to from the machine.
That only means you have to have root on a box which you stick on the
network to fake being an update server/DNS. So it probably means your
labful of script kiddies can't run the exploit software (unless
they've already got root).
Or they have a laptop that they can bring in and plug into the
network. There's source code, too, so it doesn't even have to be an
Apple laptop.
It looks pretty serious and genuine to me. Once they have the
software running on the network, and you've installed the modified
version of the sshd, they can log into any account, even
administrator, and you won't know they're doing it.
Anthony
--
----------------------------------------------------
HyPEraCtiVE? HeY, WhO aRE YoU cALliNg HypERaCtIve?!
[EMAIL PROTECTED]
----------------------------------------------------
