Re: [cobalt-security] Hacked RaQ4 - findings

[Lawrence Frewin of Accommodation.com]

> Cronjob for user "root" which restarts /usr/sbin/init (318004 bytes) every
> five minutes. The running process /usr/sbin/init has nothing to do with
the
> normal "init", which is located in /sbin/init (27176 bytes).
>
> So I removed both the cronjob and the file /usr/sbin/init after killing
the
> process.
>

We found the same hack in a RAQ3 in February, along with a few other
problems too.

See http://groups.yahoo.com/group/raq/message/8554b for details

Lawrence

_______________________________________________
cobalt-security mailing list
[EMAIL PROTECTED]
http://list.cobalt.com/mailman/listinfo/cobalt-security