Root compromise on systems that are unpatched or running old OS versions. Compromised user-level accounts that are leveraged to gain further access. We continue to receive almost daily incident reports about intruders who have installed packet sniffers on root-compromised systems. These sniffers, used to collect account names and passwords, are frequently installed as part of a widely-available kit that also replaces common system files with Trojan horse programs. IP spoofing attacks We continue to receive several reports each week of IP spoofing attacks.
Intruders attack by using automated tools that are becoming widespread on the Internet.
Some sites incorrectly believed that they were blocking such spoofed packets, and others planned to block them but hadn't yet done so. We still receive new reports each week about intruders attempting to exploit vulnerabilities in the sendmail program mailer facility. NFS and NIS attacks, and automated tools to scan for vulnerabilities We receive weekly reports of intruders using automated tools to scan sites for hosts that may be vulnerable to NFS and NIS attacks. Intruders are continuing to exploit the rpc.ypupdated vulnerability to gain root access, and intruders are still exploiting widely known vulnerabilities in NFS to gain root access. The CERT Coordination Center has a new Web site.