Re: [cobalt-security] hacked again!

[Bill Irwin <bill_irwin@xxxxxxxx>]

Kai,

When you do the OS Restore. Be sure that the server is NOT connected to
the Internet untill ALL the patches have been applied. We have seen
cases where the server was hacked within minutes of being back online
and BEFORE the patches were applied. If you have on infected machine on
a network of several, this is all it would take to re-infect the
machine. 

You should adopt the philosophy of the Boy Scouts: Be prepared! Have
good backup procedures and have all your clients backup their work
before uploading to your site. This way they will have original copies
of their work. We would like to believe we can be impervious or
invincible to these kinds of attacks, be we know it will never happen.
Hackers are persistent and will always find a way to exploit services to
gain access to a server. You should turn off all services your users
don't need. You should also adopt strict security measures on the server
by only allowing SSH connections, etc. Things like this can minimize
your risks.

-- 
Bill Irwin
Technical Support Engineer
Sun Microsystems, Inc.