[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

strange AIDE reports

  I keep receiving strange reports from AIDE. The number of changed
files increases monotonically daily and the affair started immediately
after installation, so I doubt there has been a break-in - unless
someone managed to spoof my DNS queries or hijack my connections to
ftp.fi.debian.org. Aside from the understandable (are they, really?)
changes in Ctimes of /dev/xconsole and /dev/tty*, I get the following
(for example):
File: /usr/bin/splay
MD5: old = nuNALnPFG98QSxxAeJ2rZw== , new = hBi7I+KhEOWW5mfSciXJlg==
SHA1: old = 3lpox5dX50hvj3p6z0nyZ/cshFg= , new = mFPQd21+i8fF2LQJVZLitJZFx2U=

File: /usr/lib/Amaya/applis/bin/amaya
MD5: old = IQwcW65xdJIoC3/pAh6P8A== , new = 2HG/njXLRrF1GTp7Rd3EVw==

  The software versions are (all are unstable/i386):
Package: aide
Version: 0.7-10

Package: splay

Package: amaya
Version: 5.1-1

  Any ideas except a break-in?

		| Juha Jäykkä, juolja@utu.fi			|
		| home: http://www.utu.fi/~juolja/		|

Reply to: