Re: [cobalt-users] RAQ4 Some system files change ex: ls, top, netstat, login What's wrong ?

[Gerald Waugh <gwaugh@xxxxxxxxxxxxxxxxxxxxxxx>]

On Mon, 21 Oct 2002, Nucharin Jansen wrote:

> I couldn't access website at 18 - 20th.
> I request to reboot the RAQ4.
> When NOC reboot at 20th, I can't SSH.
> So, I enable  and use telnet to check.
> I found that many system files was replace by new one.
> ex:
>
>  /bin
> -rwxr-xr-x   1 root     root       184023 Oct 18 22:03 ls
> -rwxr-xr-x   1 root     root       258612 Oct 18 22:03 netstat
> -rwxr-xr-x   1 root     root        47388 Oct 18 22:03 ps
> -rwxr-xr-x   1 root     root        43336 Oct 18 22:03 login
>
> /sbin
> -rwxr-xr-x   1 root     root        28696 Oct 18 22:03 syslogd
>
> /usr/bin
> -rwxr-xr-x   1 root     root       117311 Oct 18 22:03 du
> -rwxr-xr-x   1 root     root        22459 Oct 18 22:03 killall
> -rwxr-xr-x   1 root     root        24147 Oct 18 22:03 pstree
> -rwxr-xr-x   1 root     root        68692 Oct 18 22:03 top
>

  Looks like you have definitely been hacked!

--
http://frontstreetnetworks.com | http://raqware.com
Front Street Networks LLC  | Phone: +1 203-785-0699
229 Front Street, Ste. C, New Haven, CT. 06513-3203