RE: Trojan of somesort - Update

["James C Slora Jr" <Jim.Slora () phra com>]

> Can you elaborate on how the box was "hacked"?  I'll admit 
> that I've perhaps missed one or two of the posts in this 
> thread...and since the SF lists aren't up to date, I can't 
> research those.  
>
> What information did Bob provide to indicate a "hack"?

> From BtB's original post

> > I am currently doing an investigation into a compromised system. Before
pulling the plug I netcatted to a suspicous open port and received the
following banner:
> >          220 SiGN - FR33-FXP3rs - On Da FUcKiNG C@S£!!!

- suspicious open port (not normal FTP port for that system)
- FXP FTP server banner on that port

I don't know of a way to make these happen without abusing the system from
the inside or compromising it from the outside.