Re: Some details in a recent NT hack we encountered

[Matt Scarborough <vexversa () USA NET>]

On Sun, 25 Feb 2001 10:15:18 -0700, Ron Grove <rgrove () HOTMAIL COM> wrote:

> Just wanted to share some of the footprints of a hack that we had on one of
> our NT servers.  This is not everything I am sure.  It was too important to
> rebuild and secure the server for the users usage again.  If anyone else has
> noticed this please let me know.

I sent details on this to the Incidents list on February 20, 2001. It would
have helped you find what is missing. I captured the entire kit.

Unfortunately, that post does not appear in the SecurityFocus.com Incidents
archive as of 2001-02-25.

Strange, since I am certain the post was distributed. I received the expected
flood of out-of-office replies and the odd sales pitch. Somebody at SANS
apparently got it because they posted info about it and I assuredly *did not*
send it to SANS myself.

Go figure,

Matt 2001-02-25

____________________________________________________________________
Get free email and a permanent address at http://www.amexmail.com/?A=1