[ILUG] Possible hack?
rick at linuxmafia.com
Tue May 28 15:37:02 IST 2002
Quoting Barry O'Donovan (barry.odonovan at ucd.ie):
[Tripwire log excerpts:]
> Added object name: /bin/crond
> Modified object name: /bin/ps
Prima facia evidence that your system has been cracked, indeed.
Here's a set of suggested recovery steps. (There are others.)
Cheers, The difference between common sense and paranoia is that common sense
Rick Moen is thinking everyone is out to get you. That's normal; they are.
rick at linuxmafia.com Paranoia is thinking they're conspiring. -- J. Kegler
More information about the ILUG