Re: RedHat compromise

[Dave Dittrich <dittrich () CAC WASHINGTON EDU>]

> No IP addresses are reflected in /var/log/messages nor
> /var/log/secure, and I am unable to determine from where the attack
> came, but date/time stamp on the files shows it occured on Feb 19,
> at 05:05 localtime.  How can I find where it came from?

Start digging:

        http://staff.washington.edu/dittrich/misc/forensics/

--
Dave Dittrich                           Computing & Communications
dittrich () cac washington edu             Client Services
http://staff.washington.edu/dittrich    University of Washington

PGP key      http://staff.washington.edu/dittrich/pgpkey.txt
Fingerprint  FE 97 0C 57 08 43 F3 EB 49 A1 0C D0 8E 0C D0 BE C8 38 CC B5