[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [cobalt-security] Hacked RaQ4 - findings
- Subject: Re: [cobalt-security] Hacked RaQ4 - findings
- From: "Lawrence Frewin of Accommodation.com" <Lawrence@xxxxxxxxxxxxxxxxx>
- Date: Wed, 18 Apr 2001 21:11:08 +0100
- List-id: Mailing list for users to address network security on Cobalt products. <cobalt-security.list.cobalt.com>
> Cronjob for user "root" which restarts /usr/sbin/init (318004 bytes) every
> five minutes. The running process /usr/sbin/init has nothing to do with
the
> normal "init", which is located in /sbin/init (27176 bytes).
>
> So I removed both the cronjob and the file /usr/sbin/init after killing
the
> process.
>
We found the same hack in a RAQ3 in February, along with a few other
problems too.
See http://groups.yahoo.com/group/raq/message/8554b for details
Lawrence