The bogus user accounts were used to create similar accounts on the file server and six other workstations by exploiting the trust relationships and NFS file sharing arrangement employed in the laboratory. The incident was contained by pulling the network connections from each machine. A mysteriously-open port 31337 was identified as an indication of a possible Trojan horse running on the server, but the application associated with the open port was not identified. The effects of the attack were eradicated after user data was dumped to a neutral AFS file server by wiping the disks completely clean and restoring the operating system. User data was then restored from the AFS server.
Several upgrades make the recovered system more secure than it was before the attack.
The NFS file sharing system and the associated trust relationships have been replaced by an AFS file sharing system that uses Kerberos for user authentication. Clearly, the rapid identification of the incident minimized the damage, but luck played a bigger role in that identification than did thorough preparation. The system administrators clearly dodged a bullet and have taken steps toward securing the network from future attack, but clear procedures should be published for the handling of future incidents.