Re: [SLUG] Re: slug Digest, Vol 29, Issue 5

[Daniel Pittman <daniel@xxxxxxxxxxxx>]

david.lyon@xxxxxxxxxxx writes:
> Quoting Darryl Barlow <dgbarlow@xxxxxxxxx>:
>
>> I had the pleasure some years ago of a cracker gaining access to a Linux box
>> on my work Network running SME Server.
>
>> I still do
>> not know how the attacker located the machine.  I presume it was probably
>> through a port scan .....
>
> I have seen the same thing with other installs of SME Server. The
> machines I saw it on were properly firewalled and not even visible.
>
> People I know have come to the conclusion that it was software already
> embedded within the system at distribution. It got activated in idle
> time. It was doing spam mass mailing.

Which release of SME Server was this?  Having done some auditing, and
worked with customers who ran SME Server systems for some years without
incident -- but only on older versions -- I am surprised at this claim.

Do you have any supporting evidence for that?  Alternately, did the
folks you know write this up anywhere?

Regards,
        Daniel