[Savannah-hackers] subversions hacked?

[Hugo Gayosso]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I guess some of you already saw this message, but I didn't see any
comments on either system-hackers nor on savannah-hackers, so here it
is:

I am truncating parts of the message, in summary a lot if not all of
the shell accounts in subversions were removed from '/etc/passwd' and
a bunch of other accounts (suspicious usernames) were created:

From: address@hidden (subversions's file diff daemon)
Subject: subversions:/etc/passwd -- recent changes
To: address@hidden
Date: Tue, 18 Mar 2003 04:00:20 -0500
Reply-To: address@hidden

This is an automated report from subversions.
Recent changes to /etc/passwd:

 252 -rw-r--r--    1 root     root       251121 Mar 17 12:26 /etc/passwd

diff  -u0  /home/diffmon/old_file_dir/subversions:!etc!passwd.gz /etc/passwd
- --- /tmp/diffmon9404  Tue Mar 18 04:00:19 2003
+++ /etc/passwd Mon Mar 17 12:26:14 2003
@@ -36,153 +36,30 @@
- -anoncvs:x:1003:1003:Anony Mouse Read-only CVS 
User:/home/empty:/usr/local/bin/cvssh
- -michael:x:1004:65534:Michael Hanni 
<address@hidden>:/home/michael:/usr/local/bin/cvssh
- -jonas:x:1042:65534:Jonas Öberg <address@hidden>:/home/jonas:/bin/bash
- -thomas:x:9107:65534:Thomas Bushnell, BSG 
<address@hidden>:/home/thomas:/bin/bash
- -kwzh:x:31508:65534:Karl Heuer <address@hidden>:/home/kwzh:/usr/bin/rc
- -mhw:x:31613:65534:Mark H. Weaver <address@hidden>:/home/mhw:/bin/bash
- -alex:x:60001:65534:Alexander Langer 
<address@hidden>:/home/alex:/usr/local/bin/cvssh

[ truncated for brevity ]

+0rfelyus:x:62520:65534:Daniel Skarda 
<address@hidden>:/home/0rfelyus:/usr/local/bin/cvssh
+1984:x:60357:65534:M.-A. DARCHE 
<address@hidden>:/home/1984:/usr/local/bin/cvssh
+3diff:x:60216:65534:Brian Youmans 
<address@hidden>:/home/3diff:/usr/local/bin/cvssh
+AGustan:x:61602:65534:Aurelien Gustan 
<address@hidden>:/home/AGustan:/usr/local/bin/cvssh
+AaronM:x:61539:65534:Aaron M. 
<address@hidden>:/home/AaronM:/usr/local/bin/cvssh
+AdamFSmith:x:62452:65534:Adam F. Smith 
<address@hidden>:/home/AdamFSmith:/usr/local/bin/cvssh
+Agamenon:x:62196:65534:Raul Garita Chacón 
<address@hidden>:/home/Agamenon:/usr/local/bin/cvssh
+Aiua:x:63183:65534:Adrien de Sentenac 
<address@hidden>:/home/Aiua:/usr/local/bin/cvssh
+AlwaysGoodTimes:x:63188:65534:Zurab Davitiani 
<address@hidden>:/home/AlwaysGoodTimes:/usr/local/bin/cvssh
+Ankh:x:62421:65534:Liam Quin <address@hidden>:/home/Ankh:/usr/local/bin/cvssh
+ArauKo:x:62748:65534:Luis Araujo 
<address@hidden>:/home/ArauKo:/usr/local/bin/cvssh
+ArbreVert:x:62743:65534:ArbreVert 
<address@hidden>:/home/ArbreVert:/usr/local/bin/cvssh
+Arvoreen:x:63205:65534:Paul Bettinger 
<address@hidden>:/home/Arvoreen:/usr/local/bin/cvssh

[ truncated for brevity ]

- -mirko:x:60178:65534:Mirko Viviani 
<address@hidden>:/home/mirko:/usr/local/bin/cvssh
- -lmiguel:x:60179:65534:Luis Miguel Arteaga Mejía 
<address@hidden>:/home/lmiguel:/usr/local/bin/cvssh
- -csillag:x:60180:65534:Csillag Kristóf 
<address@hidden>:/home/csillag:/usr/local/bin/cvssh
- -paulv:x:60181:65534:Paul Visscher <address@hidden>:/home/paulv:/bin/bash
- -srbaker:x:60184:65534:Steven R. Baker 
<address@hidden>:/home/srbaker:/usr/local/bin/cvssh
- -jagapen:x:60185:65534:Jonathan Gapen 
<address@hidden>:/home/jagapen:/usr/local/bin/cvssh
- -nico:x:60186:65534:Nicola Pero 
<address@hidden>:/home/nico:/usr/local/bin/cvssh
- -mrbrocoli:x:60187:65534:Alfredo K. Kojima 
<address@hidden>:/home/mrbrocoli:/usr/local/bin/cvssh
- -chunsj:x:60188:65534:Sungjin Chun 
<address@hidden>:/home/chunsj:/usr/local/bin/cvssh

[ truncated for brevity ]

+Jonesy:x:62365:65534:Chris Jones 
<address@hidden>:/home/Jonesy:/usr/local/bin/cvssh
+JonnyQ:x:62296:65534:Ricardo Sousa 
<address@hidden>:/home/JonnyQ:/usr/local/bin/cvssh
+KaRMa:x:61872:65534:Massimo Bilvi 
<address@hidden>:/home/KaRMa:/usr/local/bin/cvssh
+Kandjar:x:61740:65534:Cédric Lallain 
<address@hidden>:/home/Kandjar:/usr/local/bin/cvssh
+Lahm:x:62776:65534:Lanzani Giuseppe 
<address@hidden>:/home/Lahm:/usr/local/bin/cvssh
+Lemming:x:62846:65534:David Westley 
<address@hidden>:/home/Lemming:/usr/local/bin/cvssh
+Liz_Dodd:x:61803:65534:Elizabeth Dodd 
<address@hidden>:/home/Liz_Dodd:/usr/local/bin/cvssh

[ truncated for brevity ]


- -- 
Hugo Gayosso
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+d+TVMNObVRBZveYRAsBxAJ4yN3ThKGWiFbyN893GD2jCX+k8+wCeNnzT
Wv9OQF3uGyk1eZm2zo+wF7s=
=1w3/
-----END PGP SIGNATURE-----