[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [SLUG] An "I love you" worm on linux



Adam Kennedy wrote:
> 
> Morning all
> 
> This is so weird I had to send it to the list
> 
> I have been having trouble connecting to a CVS server from inside a
> masquarade behind a new ADSL connection
> 
> Any action seems to hang for a long period of time.
> 
> I used sniffit to sniff the connection, and after seeing the client ( very
> slowly ) manage to connect, the server proceeded to fire back the following,
> one every 30 seconds or so
> 
> I LOVE YOU. I LOVE YOU.
> 
> Now, has anyone seen this before?

Yup, it's part of the CVS handshake protocol.

cvs/src/server.c:

    /* The Authentication Protocol.  Client sends:
     *
     *   BEGIN AUTH REQUEST\n
     *   <REPOSITORY>\n
     *   <USERNAME>\n
     *   <PASSWORD>\n
     *   END AUTH REQUEST\n
     *
     * Server uses above information to authenticate, then sends
     *
     *   I LOVE YOU\n
     *
     * if it grants access, else
     *
     *   I HATE YOU\n
     *
     * if it denies access (and it exits if denying).
    ... etc.

-- 
Del

-- 
SLUG - Sydney Linux User Group Mailing List - http://slug.org.au/
More Info: http://lists.slug.org.au/listinfo/slug