[plug] Am I Being Hacked?

[Garth Atkinson]

"Earnshaw, Mike" wrote:
> 
> List,
> 
> Noticed this in the log today ....
> 
> =====start=====
> 
> Security Violations
> =-=-=-=-=-=-=-=-=-=
> May  8 17:49:59 usswa login[14597]: FAILED LOGIN 1 FROM (null) FOR
> z.a^Z?toE~o^Pm%?^A^Ga^GLC, User not known to the underlying authentication
> module
> May  8 17:50:03 usswa login[14597]: FAILED LOGIN 2 FROM (null) FOR
> ÕSåtƳÿçþD4ôÿï~ÿ}#À!}!}%} }4}"}&} }*} } }%}&}
> }!ï}9}'}"}(}"p¯~Tþ$âê%/-ïÉÁÂ^SG"h^B'<^_³^VÌÊ?¿ó÷sÿõ^Oï;Óq-, User not known
> to the underlying authentication module
> May  8 17:50:11 usswa login[14597]: FAILED LOGIN 3 FROM (null) FOR
> ~ÿ}#À!}!}&} }4}"}&} }*} } }%}&}
> }!ï}9}'}"}(}"º}2~Pü Ãô?¡ïO?-?>^W´8yY^A-YþÛÿ>Åï^RS$I'ÊùËo¥ÿÔÿ¤û(tm)Iþÿï~¢f·¨1
> 2CûþÎäI¼×GÝ^N|^PÜÿï~ÿ}#À!}!}'} }4}"}&} }*} } }%}&} }!ï}9}'}"}(}"ó?~6Y, User
> not known to the underlying authentication module
> May  8 17:50:12 usswa login[14597]: FAILED LOGIN SESSION FROM (null) FOR
> ,4d8Ñó*...©úÞ\ÀÒ ç£^VÌä"þ^], User not known to the underlying authentication
> module
> 
I have seen similar log messages when running mgetty (which used
/bin/login) on a serial port with a very shoddy serial cable. I would
get crap like this in the logs whenever there was no device (normally a
Wyse 60 terminal) connected to the cable.

Garth