Re: [TCLUG:15603] Possible attack?

[Jeff Keacher <teuobk@ringworld.org>]

Any idea how much free memory you had?  Looks like you ran out of memory
and the kernel simply started killing things...

Cheers,
Jeff


Kevin Bullock wrote:
> 
> Hey all --
> 
> Something very strange and suspicious just happened -- my box was brought
> to a grinding halt for a completely unknown reason. The only unusual thing
> I can find in my logs is:
> 
> Apr  5 21:05:23 dysonsphere kernel: VM: killing process xscreensaver
> Apr  5 21:06:11 dysonsphere kernel: VM: killing process gnome-terminal
> Apr  5 21:09:11 dysonsphere kernel: VM: killing process communicator-sm
> 
> And those were after the system became useable again. The other wierd
> thing is this in a finger @localhost:
> 
> kbullock  Kevin Bullock  *pts/0       1  Apr  5 14:34 (lisieux.cs.csbsju.edu)
> 
> lisieux.cs is the machine in the CS lab that I was logged into earlier
> today. This persists even after I shut down sshd (which was how I logged
> in).
> 
> Could this have been an attack of some sort? No cron jobs were scheduled
> to run, and none ran. Why did this happen?
> 
> Pacem in Terris / Mir / Shanti / Salaam / Heiwa
> Kevin R. Bullock
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tclug-list-unsubscribe@mn-linux.org
> For additional commands, e-mail: tclug-list-help@mn-linux.org