On Fri, May 25, 2001 at 09:24:00AM -0700, Eric Robinson wrote:
 
> Members of this list who suggest that you should reformat and reinstall
> after a hacking inicdent are only partially correct. Starting with a clean
> slate is the only way to be sure you have eliminated your problem if you
> don't already know the exact nature of the attack. In this case, we do. :-)

No, you don't, until you've run the exhaustive forensic analysis.  Until
then, you're guessing.  Encouraging people to break one of the foremost
rules of computer security is just plain bad advice.

If you are diagnosing based on symptoms, then you are putting yourself
at the mercy of the attackers.  You are gambling on their complacency.

Bad move.

-- 
Devin L. Ganger <[EMAIL PROTECTED]>
find / -name *base* -exec chown us:us {} \;
su -c someone 'export UP_US=thebomb'
for f in great justice ; do sed -e 's/zig//g' < $f ; done
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]

Reply via email to