"Cordula's Web" <[EMAIL PROTECTED]> writes:

> I've finally found the culprit with a traditional method:
>   * md5 (binary from an uncompromised machine) on all files
>   * reinstalling from scratch (not buildworld, but really
>     installing from FTP)
>   * md5 again and diff.


> Ugh... system clean again at last. :)

You can't be sure.  The attacker probably put an suid binary somewhere
besides the normal system binaries, in which case it's still there and
you may still be vulnerable.  When you know you've been hacked, you
need to wipe the disk and *really* reinstall from scratch.  And be
very careful about what you restore from backups, too.
[EMAIL PROTECTED] mailing list
To unsubscribe, send any mail to "[EMAIL PROTECTED]"

Reply via email to