user invisibility (Cloaking)

[Mark Fedor]

> From: notch at srcsip.UUCP (Michael k Notch)
> Subject: invisibility.

> I have heard a rumor that it is possible for a user on 4.2bsd to go
> invisible to other users. 
> Has anyone else heard this rumor and possibly confirm it.
> Also, if it is true, could someone explain to me how it is done.
> Thanks. I will take this in the strictest confidence.

  I have made myself invisible to other users while I was logged in by
writing a program that reads utmp, finds my entry, nulls it out, and
then writes back the new utmp.  This effectively eliminates you from
`who',`finger',and `w'.  However, this does not eliminate you from `ps'.
`ps' looks in kmem and eliminating yourself from kmem (process tables)
looks pretty sticky.  Obviously, you need super-user privileges to cloak
yourself.  Also, some unknowing user who logs in during the split second
you modify utmp might find themselves cloaked.

If anybody has attempted a cloak from `ps', I would like to know the details.
Send details by E-mail.

-- 
=========================================================
USENET:	{decvax,ihnp4,cmcl2,vax135}!cornell!lasspvax!icc
ARPA:	icc%lasspvax at Cornell.arpa
MAIL:	Instructional Computing Center
	11 Snygg Hall, SUNY at Oswego
	Oswego, New York  13126
PHONE:	(315) 341-3055
=========================================================