Coming soon: How to spam as root user

Recently, I saw a hack script spamming localhost which oddly showed as from authenticated root user: 2019-09-15 16:07:43.827 [3913] 1i9aoB-000116-PE SMTP connection identification H=localhost A= P=34201 M=1i9aoB-000116-PE U=root ID=0 S=root B=authenticated_local_user This is weird because the script was being run by a local non-root user and should have shown something like the following in the … [Read more…]