RE: [cobalt-users] Ok. I have been hacked and I have the .bash_history that shows how it was done

["Gavin Nelmes-Crocker" <cobalt@xxxxxxxxxxxxxxxx>]

> This is great.  I have the complete transcript of what happened.  In the
> .bash_history I have where the hacker went to get his tar.gz
> files and how
> he/she used them.
>
> I downloaded all the tar.gz files that the hacker downloaded and
> I have the
> yahoo account he/she used to mail files to.  So now what do I do?

Not a very clever hacker then assuming they don't read this list I would
call your local police department and hand the info over in the UK we have a
special computer sqad for this sort of thing.  Of course that doesn't mean
anything will get done so you could just ignore it rebuild the server apply
all patches and get back to work.

More interesting for the list is do you have any idea how you were hacked -
was the box fully patched, do you use ssh instead of telnet and was telnet
turned off do you use ssl for the admin pages.

Gavin