Full Disclosure mailing list archives
Jabberstudio.org compromised
From: Devdas Bhagat <devdas () dvb homelinux org>
Date: Sat, 29 Jan 2005 23:21:38 +0530
Just a heads up for everyone: <quoting jabberstudio.org> What's Happening? It has been discovered that the server hosting JabberStudio has been hacked (cracked if you want to say that) for what appears to be one year. Careful analysis of logs and other information shows that the attack was an automated rootkit and it was never used to view or alter files. Regardless, we feel it is vital that all files be reviewed for any malicious changes before they are copied over to new machines and publicly distributed again. First, we suggest that anyone that has used JabberStudio change their external passwords, especially if they connected to any machine from the JabberStudio shell server. All user accounts on the machine have been suspended until the new machines are finalized, so don't attempt to change your shell server password. </quote> A whole year? Don't these guys use tripwire or aide or equivalent? Or are they just overloaded with real life? Devdas Bhagat _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Jabberstudio.org compromised Devdas Bhagat (Jan 29)