RE: [cobalt-users] Signs That Your System May Have Been Compromised

["Dan Kriwitsky" <webhosting@xxxxxxxxx>]

> Dan, thanks for the input, but I have to tell you that I've spent the
> last three weeks reading the archives. The archive is what sent me to
> cert.org, and made me start looking into the directions they gave to
> find out if I'd been compromised. As far as I know, there is nothing in
> the archives about using the command "find / -user root -perm -4000
> -print"
>
> Can you give any guidance on this issue? Below are the files which were
> returned by giving the above command:
>

I would try to find any *.pl or *.cgi on the server calling that. It's
possible someone has an insecure script running would be my guess, rather
than someone getting access some other way. If they had root access I think
they would have probably done more than just defaced a web page.

--
Dan Kriwitsky