RE: [cobalt-users] hacked raq3 Info

[flash22@xxxxxxx]

On Sun, 25 Feb 2001, Lennie Core wrote:

> Well they got me too !

Ouch :(
> 
> I did notice just before we pulled the plug that there was an la.pid 
> file in my root.
> the la.pid contained one line. a number 16459
> If that's a clue as to their personal identification. Perhaps some
> of the experts on this list can inform me.

Probably just the process id of some program they were running, should
have been in /var/run/ , had you done a ps on that number you might have
gotten the program's full name...

> Other than that I found a chkroot kit installed. I never did it. And I 

Or someone was making sure their kit was cleaned up enough to avoid simple
detection...

> Anyways, wiped it all out did the restore CD thing and all the 
> current updates. So far 3 days and running. 
> Disabled Telnet... Put up ssh and only open ftp on request..

Best solution, painfull education :)

gsh