RE: [cobalt-security] I've been hacked -- now what do I do?

["Justin" <ronin@xxxxxxxxxxxxx>]

Steve -
	I know this is one of those obvious things, but you might wanna take the extra
time to secure the box before making it live next time.  Adding security
updates, firewalls configs, Tripwire, etc.. will almost always pay off in the
end.
	One other thing, just because these are implace doesn't mean your box is
secure.  YOu have to stay up-to-date with security patches and the like.

Just my two cents...

- Justin

> -----Original Message-----
> From: cobalt-security-admin@xxxxxxxxxxxxxxx
> [mailto:cobalt-security-admin@xxxxxxxxxxxxxxx]On Behalf Of Steve Beach
> Sent: Monday, November 06, 2000 3:24 PM
> To: cobalt-security@xxxxxxxxxxxxxxx
> Subject: [cobalt-security] I've been hacked -- now what do I do?
>
>
> Dear All;
>
> Stupid question time -- I've been hacked, so what do I do now?  With a
> regular box, I'd re-install everything and be done with it.
> But I can't
> just reboot with a floppy in the disk drive if there isn't any disk
> drive, so what do I do to reload a known clean system?
>
> Thanks for your support,
>
> Steve Beach
>
> P.S.: I say I've been hacked because there is a program
> called "nothing"
> that starts on boot, and appears to do nothing but run what
> looks to be
> a trojaned "sleep".  I'm not sure it's trojaned, since I
> didn't install
> tripwire or anything before I put it online.  Oh well, next time.
>
>
> --
>
> Penn State University Experimental Particle Astrophysics
> 104 Davey Lab, University Park, PA  16802
> asb4@xxxxxxx, http://landau.phys.psu.edu
>
> ------------------------------------------------------------
> |  Can't keep my mind from the circling sky                |
> |  Tongue tied and twisted, just an earth bound misfit, I  |
> ------------------------------------------------------------
> _______________________________________________
> cobalt-security mailing list
> cobalt-security@xxxxxxxxxxxxxxx
> http://list.cobalt.com/mailman/listinfo/cobalt-security
>