Aar큙  0 UP`` 0` 0 ```P@HH $ @d HHHH̀̀̀ff@  d Footnote TableFootnote**.\t.\t/ - :;,.!?- cs: c0TOCHeading1Heading2   AEquationVariablesT2::= :99;;R<<$monthname> <$daynum>, <$year>"<$monthnum>/<$daynum>/<$shortyear>;<$monthname> <$daynum>, <$year> <$hour>:<$minute00> <$ampm>"<$monthnum>/<$daynum>/<$shortyear><$monthname> <$daynum>, <$year>"<$monthnum>/<$daynum>/<$shortyear> <$fullfilename> <$filename> <$paratext[Title]> <$paratext[Heading1]> <$curpagenum> <$marker1> <$marker2> (Continued)+ (Sheet <$tblsheetnum> of <$tblsheetcount>)Heading & Page <$paratext> on page<$pagenum>Pagepage<$pagenum>See Heading & Page%See <$paratext> on page<$pagenum>. Table All7Table<$paranumonly>, <$paratext>, on page<$pagenum>Table Number & Page'Table<$paranumonly> on page<$pagenum>AHeadings-kHTMLA##%%''Ag5y::: 55: 999::::: ::::?:A:C:E:G:I:K:M:O:|:~::::::::::::::::::::::::::::;;;;;!;#;%;';);T;V;X;Z;\;^;`;b;d;fS;jSSO;;;;;;S;;;;;;;S;;;;;;;S;;;;;SSOSSOSSP<<<>>>> > > >>>>>>>>>>!>#>%>'>)>+>->/>1>3>5>7>9>;Pb>?>A>C>E>G>I>K>M>O>Q>S>U>WPdJEPJQ\K=QpKQQKQKRK@@@3AA AAA AO(O)O*-1.O+02.NRRRRRRRRRRRRRRRRRRRRRRRRRRRRRSS S S.S0S{S}SSSSndqd:d9 HmR9HmRHRHR Footnote Hr@9Hr@HzHz Single LineH9Footnote 9  HD9 HDHH Double LineH9 Double Line9 9 H9  Single Line9 HZ9  TableFootnote EGxR9EGxREPwEPw TableFootnoted5p HHˆ5xHHˆGe HHˆ5zHHˆl $$:$$gtGBm V $$:$$l} : GeHeadings Table } :  Ge } :  Ge }l: lG eHeading Level HUV 5HUV Ge HUV 5HUV l H$ 5H$ Ge H$ 5H$ l HHˆ5HHˆ   `Puzzle of the Day q Your UNIX system has been attacked. The  uucp  entry in your /etc/passwd file has a UID of 0. You have run  ps  to see 0}if any unusual processes were executing. None were. You ran  ls  to find any unusual files or directories. None were @reported. You ran  du  to determine if the size of any file system was unusually large (indicating hidden files). Nope. rQ vYou suspect that someone has, somehow, hidden files (or directories) and an executing process. You decide to start at 0]the /dev directory, to see if they created any new device files. Again, an  ls  lists only those files you expect to see. But @;you are still suspicious, and want to confirm the results. sx`What would you do? t zYou still suspect that the attacker left an illicit process executing. But  ps  showed nothing. How would you con@$firm or refute your suspicion?  Qu` HHˆ5HHˆl}: G eParagraph Format }:!G e Comments }l: )lGe2 d9#'H$ 9"%H$ $$ l H$ 9"H$ #WlKNovember 24, 1999 ECS 153 F ALL  1999 Page  [1 \ HUV 9"#'HUV && l HUV 9"HUV %W l6Version of   bNovember 25, 1999 11:03 pm a HHˆ9"%HHˆ(( l HHˆ9"HHˆ'W ` }:!*GUTe Heading1 }:)uGe d:8-- $$:9+$$0a-0XSNID?:50+& }x l^bf~zvrnjUX[IMQ.14FC@=:7GBm ` _ ^ ] Z W $$:;+$$%,,l}$ :>iT1$ jWeCharacter Macros }l :@il jWe } :Bi jWe }$H:Di.2$HjW e Character }l:Fi13ljW e Replace With }:Hi24jW e Comments }$H:Ji35$HjW e }l:Li46ljW e¢ }:Ni5FjW e }$H:{i<8$HjW e }l:}i79ljW e... }:i8jW e }$H:i?;$HjW e }l:i:<ljW e- }:i;7jW  e }$H:iB>$Hj W! e }l:i=?lj W" e-- }:i>:j W# e }$H:iEA$Hj W$ e }l:i@Blj W% e° }:iA=j W& e }$H:iHD$Hj W' e }l:iCElj W( e® }:iD@j W) e }$H:i6G$Hj W* e }l:iFHlj W+ e© }:iGCj W, e }$Z :i]M$Z j W-eGeneral Macros }Z :iZ j W.e }Z :iZ j W/e }\Z :i\Z j W0e }$jh:iIN$jhjW1 e Macro Name }jh:iMOjhjW2 e Replace With }jh:iNPjhjW3 eHead }\j:iOQ\jjW4 e Comments }$zh:iPR$zhjW5 e }zh:iQSzhjW6 e }zh:iRTzhjW7 e }\z:iS.\zjW8 e }$$ ;imX$$ j W9eCross-Reference Macros }$ ;i$ j W:e }D$ ;iD$ j W;e }$4;iUY$4j W< e Macro Name }4; iXZ4j W= e Replace With }D4;"iY[D4j W> e Comments }$D;$iZ\$Dj W? e See Also }D;&i[]Dj W@ eSee <$paratext> }DD;(i\IDDj WA e }$z ;S#b$z $ WBeSystem Macros }z ;U#z $ WCe }z ;W#z $ WDe }\z ;Y#\z $ WEe }$h;[#^c$h$ WF e Macro Name }h;]#bdh$ WG e Replace With }h;_#ceh$ WH eHead }\h;a#df\h$ WI e Comments }$h:;c#eg$h:$ WJ e StartOfDoc }h:;e#fhh:$ WK e }h:;g#gih::$ P4e L����e <$defaulttitle> N����e AOe }\h:;i#h\h:$ WM e }$²h;iqk$²hj WQ eEndOfLastSubDoc }²h;ijl²hj WR e }²h;ikm²hj WS e }\²h;ilU\²hj WT e }$xh:;iuo$xh:j WU eStartOfLastSubDoc }xh:;inpxh:j WV e }xh:;ioqxh::j u4e W����e <$defaulttitle> s����e Ate }\xh:;ipj\xh:j WX e }$hh;iys$hhj WY eEndOfFirstSubDoc }hh;irthhj WZ e }hh;isuhhj W[ e }\hh;itn\hhj W\ e }$.h:;iw$.h:j W] eStartOfFirstSubDoc }.h:;ivx.h:j W^ e }.h:;iwy.h::j r4e _����e <$defaulttitle> p����e Aqe }\.h:;ixr\.h:j W` e }$h;#{$h$ Wa e EndOfSubDoc }h;#z|h$ Wb e }h;#{}h$ Wc e }\h;#|\h$ Wd e }$h:;#$h:$ We eStartOfSubDoc }h:;#~h:$ Wf e }h:;#h::$ o4e g����e <$defaulttitle> m����e Ane }\h:;#z\h:$ Wh e }$h;#i$h$ Wi e EndOfDoc }h;#h$ Wj e }h;#h$ Wk e }\h;#~\h$ Wl e }$4 <#| $4 $ WveHTML Options Table }4 <#4 $ Wwe }h4 <#h4 $ Wxe }$D< # $D$ Wy eControl }D<"# D$ Wz eValue }hDH<$# hDH$ W{ e Comments }$T<&# $T$ W| e Image Format }T<(# T$ } % 0001IMAGGIF PE MACP0001GIF }hTH<*# lhTH$ W~ e } 6$$ 'W# eX:Page }H<#57H$ 'W$ e See Also }6<#686$ 'W% eN }26<#7926$ 'W& eN }h<#80h$ 'W' e }$<#C;$$ (W( eX:Heading & Page }H<#:<H$ (W) e See Also }6<#;=6$ (W* eN }26=#<>26$ (W+ eN }h=#=5h$ (W, e }$=#H@$$ )W- eC:EquationVariables }H=#?AH$ )W. eEM }6=#@B6$ )W/ eN }26= #AC26$ )W0 eN }h= #B:h$ )W1 e }$=#ME$$ *W2 e C:Emphasis }H=#DFH$ *W3 eEM }6=#EG6$ *W4 eN }26=#FH26$ *W5 eN }h=#G?h$ *W6 e }$=#RJ$$ +W7 eC:Code }H=#IKH$ +W8 eEM }6=#JL6$ +W9 eN }26=#KM26$ +W: eN }h= #LDh$ +W; e }$="#WO$$ ,W< eC:Bold }H=$#NPH$ ,W= eEM }6=&#OQ6$ ,W> eN }26=(#PR26$ ,W? eN }h=*#QIh$ ,W@ e }$=,#\T$$ -WA eP:Title }H=.#SUH$ -WB eH* }6=0#TV6$ -WC eN }26=2#UW26$ -WD eN }h=4#VNh$ -WE e }$b,=6#Y$b,$ .WF e P:TableTitle }bH,=8#XZbH,,$ .d&eLI Ge Parent = OL Qce Depth = 0 }b6,=:#Y[b6,$ .WH eN }2b6,=<#Z\2b6,$ .WI eN }hb,=>#[Shb,$ .WJ e }=@+f^, /GKeP:TableFootnote }H=B+]_H, /GLeP }6=D+^`6, /GMeN }6=F+_a6, /GNeN }=H+`, /GOe }=J+kc, 0GPeP:Rule }H=L+bdH, 0GQeP }6=N+ce6, 0GReN }6=P+df6, 0GSeN }=R+e], 0GTe },=T+ph,, 1GUe P:Numbered1 }H,=V+giH,,, 1beLI Ve Parent = OL Aae Depth = 0 }6,=X+hj6,, 1GWeN }6,=Z+ik6,, 1GXeN },=\+jb,, 1GYe },=^+um,, 2GZe P:Numbered }H,=`+lnH,,, 2`eLI [e Parent = OL A_e Depth = 0 }6,=b+mo6,, 2G\eN }6,=d+np6,, 2G]eN },=f+og,, 2G^e }=h+zr, 3G_eP:Mapping Table Title }H=j+qsH, 3G`eP }6=l+rt6, 3GaeN }6=n+su6, 3GbeN }=p+tl, 3Gce }=r+w, 4GdeP:Mapping Table Cell }H=t+vxH, 4GeeP }6=v+wy6, 4GfeN }6=x+xz6, 4GgeN }=z+yq, 4Ghe }=|+|, 5GieP:ManHeading2 }H=~+{}H, 5GjeP }6=+|~6, 5GkeN }6=+}6, 5GleN }=+~v, 5Gme }=+ , 6Gne P:ManHeading }H=+H, 6GoeP }6=+6, 6GpeN }6=+6, 6GqeN }=+{, 6Gre }=+, 7Gse P:ManBody }H=+H, 7GteP }6=+6, 7GueN }6=+ 6, 7GveN }=+, 7Gwe },=+ ,, 8Gxe P:LetteredA }H,=+ H,,, 8^eLI ye Parent = OL A]e Depth = 0 }6,=+ 6,, 8GzeN }6,=+ 6,, 8G{eY },=+ ,, 8G|e },=+,, 9G}e P:Lettered }H,=+H,,, 9\eLI ~e Parent = OL A[e Depth = 0 }6,=+6,, 9GeN }6,=+6,, 9GeY },=+ ,, 9Ge }=+, :Ge P:Indented }H=+H, :GeP }6=+6, :GeN }6=+6, :GeN }=+, :Ge }=+", ;GeP:HeadingRunIn }H=+H, ;GeP }6=+6, ;G eN }6=+6, ;G eN }=+, ;G e }=+', <G e P:Heading2 }H=+ H, <G eH* }6=+!6, <GeN }6=+ "6, <GeN }=+!, <Ge }=+,$, =Ge P:Heading1 }H=+#%H, =GeH* }6=+$&6, =GeN }6=+%'6, =GeN }=+&, =Ge }=+1), >GeP:Heading Info }H=+(*H, >GeP }6=+)+6, >GeN }6=+*,6, >GeN }=++#, >Ge }=+6., ?GeP:Hand }H=+-/H, ?GeP }6=+.06, ?GeN }6=+/16, ?GeN }=+0(, ?Ge }=+;3, @G e P:Footnote }H=+24H, @G!eP }6=+356, @G"eN }6=+466, @G#eN }=+5-, @G$e },=+@8,, AG%e P:Exercise }H,=+79H,,, AZeLI &e Parent = OL AYe Depth = 0 }6,=+8:6,, AG'eN }6,=+9;6,, AG(eN },=+:2,, AG)e }=+E=, BG*e P:Due Date }H>+<>H, BG+eP }6>+=?6, BG,eN }6>+>@6, BG-eN }>+?7, BG.e }>+JB, CG/e P:CodeIndent }H> +ACH, CG0eP }6> +BD6, CG1eN }6>+CE6, CG2eN }>+D<, CG3e }>+OG, DG4e P:CodeCenter }H>+FHH, DG5eP }6>+GI6, DG6eN }6>+HJ6, DG7eN }>+IA, DG8e }>+TL, EG9eP:Code }H>+KMH, EG:eP }6> +LN6, EG;eN }6>"+MO6, EG<eN }>$+NF, EG=e }>&+YQ, FG>eP:CellHeading }H>(+PRH, FG?eP }6>*+QS6, FG@eN }6>,+RT6, FGAeN }>.+SK, FGBe }>0+^V, GGCe P:CellBody }H>2+UWH, GGDeP }6>4+VX6, GGEeN }6>6+WY6, GGFeN }>8+XP, GGGe },>:+c[,, HGHe P:Bulleted }H,><+Z\H,,, HXeLI Ie Parent = UL AWe Depth = 0 }6,>>+[]6,, HGJeN }6,>@+\^6,, HGKeN },>B+]U,, HGLe }>D+h`, IGMe P:BodyList }H>F+_aH, IGNeP }6>H+`b6, IGOeN }6>J+ac6, IGPeN }>L+bZ, IGQe }>N+"e, JGRe P:BodyCenter }H>P+dfH, JGSeP }6>R+eg6, JGTeN }6>T+fh6, JGUeN }>V+g_, JGVe d>kk $$>i$$v9kvrnjUX[IMQ.14FC@=:7$$>i$$%jjl}$d@#m$d$ KWe e!Copy Files Imported by Reference }d@#lnd$ KWf eN }hdH@#mhdH$ KWg e *}lAwslMGke1 }ArtMGl eTitle }AsMGme }lA*vlNGne3 }AuwNGoe Heading2 }AvrNGpe }R#y$ OGve P:Numbered+ }HR#xzH$ OGweP }6R#y{6$ OGxeN }6R#z|6$ OGyeN }R#{$ OGze }R#~$ PG{e P:Lettered+ }HR#}H$ PG|eP }6R#~6$ PG}eN }6R#6$ PG~eN }R#x$ PGe }R# $ QGe P:AnswerA+ }HR#H$ QGeP }6R#6$ QGeN }6R#6$ QGeN }R#}$ QGe },R#,$ RGe P:AnswerA }H,R# H,,$ ReLI e Parent = UL Ae Depth = 0 }6,R# 6,$ RGeN }6,R# 6,$ RGeN },R# ,$ RG e }R# $ SG e P:Answer+ }HR# H$ SG eP }6R# 6$ SG eN }6R#6$ SG eN }R#$ SGe },R#*,$ TGe P:Answer }H,R#H,,$ TeLI e Parent = UL Ae Depth = 0 }6,R#6,$ TGeN }6,R#6,$ TGeN },S# ,$ TGe }Sz#$ UGeCSS Export Encoding }S|#$ UGe }HS~#^H$ UGe }S#n$ VGeExport Encoding }S#$ VGe }HS#H$ VGe dLeftd"Rightd ReferenceddHeadingsd+HTMLd#HTMLdiHTML f@D BBodyBody. @@ BBody. f@D B.Due DateBody. @@ BMapping Table Title. @@ BMapping Table Cell. f@N B Numbered N:.\t. @@BMapping Table Title. @@ BMapping Table Cell. f@ B Indented. @@BMapping Table Cell. @@ BMapping Table Cell. @@BMapping Table Cell. @@ BHeader Double Line. f@T B TableTitleT:Table : .  f@PBTitleBody. "f@ B CellFooting. f@E B BulletedBulleted. f@ B Footnote. @@ BFooter. f@T BHeading2Body. f@T B HeadingRunInBody. f@D BBodyBody. f@D BBodyBody. $f@AE B$. LetteredA A:.Lettered. f@NE B Numbered1 N:.Numbered. f@E BAnswerEmphasisAnswer: Body. f@ B TableFootnote. f@T B TableTitleT:Table : . f@TBHeading1Body. $f@A B$. Lettered A:.\t. f@D B BodyCenterBody. f@ BRule. @   $H.l..... .D.h....Code. @@ B $ H l      D h  ManHeading. f@P B Heading InfoBody. f@ B CellHeading. f@H BExerciseBoldH:Exercise . . f@ B CellHeading. f@ B Hand. f@ BCellBody. @   $H.l..... .D.h.... CodeCenter.  f@PBTitleBody. f@NE B Numbered1 N:.Numbered. $$f@D BBodyListBody. $@   $H.l..... .D.h.... CodeIndent. f@N B Numbered N:.\t. @@ B ManHeading2. @@ B $ H l      D h  ManBody. $$f@E BAnswerAEmphasisAnswer: Body. f@ BCellBody. $$f@D BAnswerA+EmphasisBody. f@D BAnswer+EmphasisBody. f@ B Numbered+. $f@ B$. Lettered+.  B BB B B B B 33BBEmphasis 33BBEquationVariables/Bold   Code BBB B B BThinMediumDoubleThick@ Very Thin H&5H&5H&5H&5H&5Format AH Mapping Table H&5H&5H&5H&5H&5Format BH Mapping Table Mlh pH  hhh   ( hhhh N UH> OH66K  N!)*$ j./0$hj123$h j456$hj789$h j:;<$h j= > ? $h j@ A B $h jC D E $h jF G H $Z jI J K L $j jMNOP$zjQRST$$ jUVW$4jXYZ$Dj[\]$z $^_`a$$bcde$:$fghi$²jjklm$x:jnopq$hjrstu$.:jvwxy$$z{|}$:$~$$$4 $$D$   $TK$   !,      ",!!!!!!#,""""""J,## #!#"#$%T$&$'$($)$*$$&$$+%,%-%.%/%$'%$0&1&2&3&4&$(&$5'6'7'8'9'$)'$:(;(<(=(>($*($?)@)A)B)C)$+)$D*E*F*G*H*$,*$I+J+K+L+M+$-+$N,O,P,Q,R,$.,$S-T-U-V-W-$b,/-$X.Y.Z.[.\.0.,]/^/_/`/a/1/,b0c0d0e0f0,20,g1h1i1j1k1,31,l2m2n2o2p242,q3r3s3t3u353,v4w4x4y4z464,{5|5}5~5575,6666686,7777 7,97, 8 8 8 88,:8,99999;9,:::::<:,;;;;;=;,<< <!<"<><,#=$=%=&='=?=,(>)>*>+>,>@>,-?.?/?0?1?A?,2@3@4@5@6@,B@,7A8A9A:A;ACA,B?B@BDB,ACBCCCDCECEC,FDGDHDIDJDFD,KELEMENEOEGE,PFQFRFSFTFHF,UGVGWGXGYG,IG,ZH[H\H]H^HJH,_I`IaIbIcI#I,dJeJfJgJhJ$dV$lKmKnK NrMsMtMMuNvNwNP$xOyOzO{O|OQO$}P~PPPPRP$QQQQQ,SQ$RR R R RTR$ S SSSS,$S$TTTTTV$UUUKU$VVVComment L9d BlackT!WhiteddARedddGreendd BluedCyandMagentad YellowHeader/Footer $1Header/Footer $1Header/Footer $2Header/Footer $2IndexIndexCommentCommentSubjectSubjectAuthorAuthorGlossaryGlossaryEquationEquation Hypertext Hypertext  Cross-Ref Cross-Ref Conditional TextConditional TextPositionFMPrivatePositionFMPrivateRangeEndFMPrivateRangeEndFMPrivate HTML Macro HTML Macro M.Times.P Times-Roman FrameRoman M.Times.B Times-Bold FrameRoman M.Courier.PCourier FrameRoman M.Times.BITimes-BoldItalic FrameRoman M.Helvetica.BHelvetica-Bold FrameRoman M.Times.I Times-Italic FrameRomanO Courier HelveticaATimes#Regular#Roman MediumBoldRegularItalic$zJ9߸[#ym>?J HKqHđ~n{i/հtD8ԊvBhO@M}Bʰ sQ ͂(ZaGm4KAjY$&qm8 ~K\