Re: Someone hacking via gnome?

[Paul Warren <pdw ex-parrot com>]

On Tue, Aug 15, 2000 at 10:40:01AM -0400, Jesse F. Hughes wrote:
> Aug 15 10:00:21 phiwumbda gmc: [orbit] connect from 206.79.84.73
> Aug 15 10:00:21 phiwumbda multiload_applet: [orbit] connect from 206.79.84.73
> Aug 15 10:00:21 phiwumbda mixer_applet: [orbit] connect from 206.79.84.73
> Aug 15 10:00:21 phiwumbda gnomexmms: [orbit] connect from 206.79.84.73
> Aug 15 10:00:21 phiwumbda another_clock_applet: [orbit] connect from 206.79.84.73
> Aug 15 10:00:21 phiwumbda cdplayer_applet: [orbit] connect from 206.79.84.73
>
> The child seems incapable of being more than a nuisance to me, but
> what is he connecting to via gnome?  Is there anything serious he can
> do?  How can I keep him out?

Upgrade to the latest version of ORBit - the latest version does not
listen on the network by default, only Unix sockets.  Assuming that
there are no security holes in ORBit then there is nothing serious he
can do, but then again, this holds for any service listening on the
network.  As the number of services increases, so does the chance of one
of them having a hole which is why you do well to minimise the number of
services running.  Also consider setting up some rules with ipchains to
block incoming connection attempts to ports except to those that you
want.

Paul