A complete revision history is at the end of this file. Many computers connected to the Internet have recently experienced unauthorized system activity.
Investigation shows that the activity has occurred for several months and is spreading.
It appears that access has been gained to many of the machines which have appeared in some of these session logs. While there is no cause for panic, there are a number of things that system administrators can do to detect whether the security on their machines has been compromised using this approach and to tighten security on their systems where necessary. In general, we suggest that site administrators be attentive to configuration management issues. Such a test can be done by comparing checksums of on-line copies of these programs to checksums of original copies. Alternatively, these programs can be periodically reloaded from original tapes.