Re: Compromised...

[friedl () MTNDEW COM (Stephen J. Friedl)]

At 12:30 PM 2/7/2000 -0600, you wrote:
> There was a directory called ADMROCKS in /var/named.

I'm now in this select club also, and fortunately I caught it right away.
The bad guy had compromised "ls", "ps", "rm", "mv", "netstat", and a host
of others, and he was quite thorough.

While trying to get the system back up enough to assess, I found that I could
not replace certain binaries in /bin with fresh-from-CD versions: a few
limited files got "operation not permitted" when I tried to rename or remove
them.

I was running Red Hat Linux 5.2: it is conceivable that he could have installed
some kind of kernel module to have helped keep him around? I still have the
old drive freeze-dried and available.

Steve

Stephen J. Friedl / Software Consultant / Tustin, CA / 714-544-6561