RE: [cobalt-security] RaQ2 Hacked within 1 day of being online

["Patrick Agee" <pagee@xxxxxxxxxxxxxx>]

KD - I doubt this hack was accomplished through any daemon exploit, as a
buffer
overflow requires working shellcode. It is doubtful that the hacker would
have known to use MIPS shellcode if he didn't know to use MIPS binaries.
Maybe they are doing brute force password guessing? How many login errors
do
you have?
PA - Only 3 login errors and then files start being changed/made.

KD - Consider the possibility that this is an inside job. Could one of your
customers / employees / former employees be doing this?
PA - Probably not inside job as I am the only one here with my company,
also the ISP where it's co-located has not hired/fired/ anybody new in last
8-10 months. IP's show the hits to mine are from Canada and one of my ISP's
Cobalt's have been hit and IP for theirs shows Europe.


_______________________________________________
cobalt-security mailing list
cobalt-security@xxxxxxxxxxxxxxx
http://list.cobalt.com/mailman/listinfo/cobalt-security