[lkml]   [2000]   [Dec]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: Is this a compromise and how?

> Pretty cool huh?
> Let me know if you would like a copy of the code.
> A quick strace shows that it binds to port 24000.
> It also contains a list of 5 IP addrs. I suspect it doesn't
> broadcast, but allows people in from those IPs.
> Anyone know what has happened? I religiously install the redhat
> updates, and am subscribed to the CERT advistors and install
> the fixes the moment I get them.
> The system was RedHat 6.2, linux 2.2.17pre14 at the time the
> breakin occured.
> I've been running firewalled with only services I provide turned
> on for access, and in /etc/inetd.conf.
> What is keeping strlib.h from appearing ls's? A hacked ls command?

Yep. Looks like a rootkit to me.


To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:28    [W:0.083 / U:0.352 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site