X-Message-Index: 007 X-Message-Prev: 005 X-Message-Next: 009 X-Thread-Prev: 004 X-Thread-Next: 008 From: Paul A Vixie To: [not phage] X-To: spaf, pleasant@rutgers.edu, jeff@gatech.edu, postmaster@cis.ohio-state.edu, fair@ucbarpa.berkeley.edu, csg@pyramid.com, cic@relay.cs.net, postmaster@relay.cs.net, postmaster@amdahl.amdahl.com, postmaster@ucsd.edu, postmaster@hplabs.hp.com, lp@decvax.dec.com, nrh@bellcore.com, smb@ulysses.att.com, trinkle, jrs, kcs, rsk, postmaster@eddie.mit.edu, postmaster@husc6.harvard.edu, postmaster@mcnc.org, zardoz!neil, postmaster@ms.uky.edu, woods@handies.ucar.edu, narten, rick@seismo.css.gov, bostic@okeefe.berkeley.edu, reid@decwrl.dec.com, johnsson@decwrl.dec.com, wild_ke%berkly.DEC@jove.dec.com Subject: damn, whoever it was did a good job. Date: Thu, 03 Nov 88 16:45:04 PST X-Date: Thu 19:45:04 03/11/1988 EST My logs show absolutely nothing that's useful in any way. Nov 3 08:26:40 localhost: 2133 sendmail: AA02133: message-id=<8811031626.AA02133@decwrl.dec.com> Nov 3 08:26:40 localhost: 2133 sendmail: AA02133: from=, size=1670, class=0 Nov 3 08:27:08 localhost: 2149 sendmail: AA02133: to=<"| sed '1,/^$/d' | /bin/sh ; exit 0">, delay=00:00:43, stat=Sent That means that there was no Message-ID: when it arrived here (which is why decwrl put one on), that the envelope sender was . This points to a strong need to log the remote host name in srvrsmtp.c somewhere... Anyway, I'd like to cooperate with anyone who wants to collect all the logging information and try to get time information together. We run NTP, which means that we have a good chance of finding out who was the first one hit if lots of others run NTP as well. Finding out who was the first one hit would be a help in tracking them down, though I don't know what else could be done. The cost in lost working time of all those sysadmins, as well as the cost of the down time for those who pulled their network connections, just won't fit in my limited mental resources. Whoever pulled this off better have intended real harm; if it was a childish prank done in humour, I'll feel that much more guilty when I tear his arms off. :-(. This story hit the radio and TV around here... Paul Vixie postmaster@decwrl.dec.com 1/4 (Disclaimer: I'm not speaking as a representative of Digital; sole responsib- ility for this message rests with me.)