[cobalt-users] AMDROCKS -- hacked systems

[Dan Heller <argv@xxxxxxxxxxxxx>]

Passing on valuable info:

On May 25,  4:49pm, James D. Williams wrote:
> This is what I just found:
> 
> 0.3.2 What is this ADMROCKS directory I've found on my machine?
> 
> Finding a directory called ADMROCKS on your host is a sign someone has
> broken into it via a BIND exploit. This directory is created by the exploit
> "t666" from the hacker group ADM. The program exploits a vulnerability on
> the BIND name server (BUGTRAQ ID 788). The exploit is targeted at Linux
> systems. This vulnerability is being actively exploited. There have been
> numerous reports of people finding this directory on their machines.
> 
> From web site:http://www.securityfocus.com I signed up, they send out
> security info to you. You can search by vendor.
> 
> Thanks,
> 
> Jim


-- 
	--dan

Photo Gallery:  http://www.danheller.com/