On Friday 31 March 2006 19:32, John Summerfield wrote: >Gene Heskett wrote: >>>---- >>>My money is on sshd - somebody with a weak password. >> >> We found a couple that were downright >> stupid/dumb/assinine/all_of_the_above. > >Since the attacker wrote to /usr I'd be looking at how he got to be > root. We haven't found that yet. We're still looking over the forensic copy we made of that drive with dd. And roots password was alpha-numeric, longer than most and certainly not susceptable to a dictionary attack. Interesting, since you made the comment re the compiler being handy, is that it wasn't used to install the irc botnet kit, only a shell, gzip, chmod & cp were used for that according to the install script we read. -- Cheers, Gene People having trouble with vz bouncing email to me should add the word 'online' between the 'verizon', and the dot which bypasses vz's stupid bounce rules. I do use spamassassin too. :-) Yahoo.com and AOL/TW attorneys please note, additions to the above message by Gene Heskett are: Copyright 2006 by Maurice Eugene Heskett, all rights reserved.
