RE: [cobalt-users] hacking

["Stephen Mc Carron" <newlyons@xxxxxx>]

Hi Jens,

When I eventually rebooted the raq3, there were mails from root to
SOLhax@xxxxxxx bouncing around, also ADMROCKS directory in my named
directory.

I have the server back up and running fine, but DNS will not go!

I really don't want to have to restore the raq and backups but is it the
only way? How does someone get into a raq like this? Is there anything I can
do to prevent/reduce the risk of further attacks???

TIA!
Stephen

-----Original Message-----
From: cobalt-users-admin@xxxxxxxxxxxxxxx
[mailto:cobalt-users-admin@xxxxxxxxxxxxxxx]On Behalf Of Jens Kristian
Søgaard
Sent: 08 May 2000 16:13
To: Cobalt User Group
Subject: Re: [cobalt-users] hacking


"Stephen Mc Carron" <newlyons@xxxxxx> writes:

> It seems my raq3 has been hacked, and the DNS services seem to be
disabled!

Are you absolutely sure it has been hacked? (how do you know?)

> Any ideas where I should start the clean-up/recovery?

Format the drive. Install from known good backups.

There is no other way.

--
Jens Kristian Søgaard,
jk@xxxxxxxxxxxx -- http://www.jksoegaard.dk/
Søger du noget? -- http://www.google.com/
echo|perl -ple'$_+=4E-6*!int rand()**2+rand()**2while$i++-1E6'


_______________________________________________
cobalt-users mailing list
cobalt-users@xxxxxxxxxxxxxxx
To Subscribe or Unsubscribe, please go to:
http://list.cobalt.com/mailman/listinfo/cobalt-users