Security Incidents mailing list archives

Re: Can anyone explain this compromise?


From: apa The <the_apa () HOTMAIL COM>
Date: Fri, 11 Aug 2000 11:34:48 GMT

We have been receiving messages like below from sites
around the world warning us that "ourhost.dom.com.au" has
been compromised. Here is one of the messages:

Other messages are exactly the same but in adition include
stuff like "you have been r00ted and trojan login, ps, su
binaries inserted"

Any ideas?

We got a similar mail and we figured that it was from some rivaling irc
person, that would explain the "3l33t" typing.
However this did not change the fact that they where right. upon loging in
to ircnet(tried efnet first ;)) if found the nick to be online using on of
our hosts.
So basicly its probably from someone who dont like SNK- and trying to stop
him from using your host to irc from.


________________________________________________________________________
Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com


Current thread: