strange AIDE reports
I keep receiving strange reports from AIDE. The number of changed
files increases monotonically daily and the affair started immediately
after installation, so I doubt there has been a break-in - unless
someone managed to spoof my DNS queries or hijack my connections to
ftp.fi.debian.org. Aside from the understandable (are they, really?)
changes in Ctimes of /dev/xconsole and /dev/tty*, I get the following
(for example):
File: /usr/bin/splay
MD5: old = nuNALnPFG98QSxxAeJ2rZw== , new = hBi7I+KhEOWW5mfSciXJlg==
SHA1: old = 3lpox5dX50hvj3p6z0nyZ/cshFg= , new = mFPQd21+i8fF2LQJVZLitJZFx2U=
File: /usr/lib/Amaya/applis/bin/amaya
MD5: old = IQwcW65xdJIoC3/pAh6P8A== , new = 2HG/njXLRrF1GTp7Rd3EVw==
The software versions are (all are unstable/i386):
Package: aide
Version: 0.7-10
Package: splay
Version: 0.9.5.1-3
Package: amaya
Version: 5.1-1
Any ideas except a break-in?
--
-----------------------------------------------
| Juha Jäykkä, juolja@utu.fi |
| home: http://www.utu.fi/~juolja/ |
-----------------------------------------------
Reply to: