Re: [cobalt-security] A hacker at work

["Steve Werby" <steve-lists@xxxxxxxxxxxx>]

"Gordon Mcdowall" <gordon.mcdowall@xxxxxxxxxxx> wrote:
> I have hashed out the ftp bit, but the guy left us with his ftp login and
> password so we are dealing with him in our own way ;o)

I'm sure you already know, but in case you haven't considered it there's a
strong likelihood that the machine he FTPed from was one he rooted or is on
a shared machine with lots of other innocent users.  So consider that by
taking action on the machine you may be affecting a person just as innocent
as your customers who were hacked.  There's no way to know for sure, but
some cursory research might give you an idea.  And in case you have
considered this and have done some research, know that when I write a
message it's for the benefit of the whole list in addition to the person I'm
replying to.

--
Steve Werby
President, Befriend Internet Services LLC
http://www.befriend.com/