Re: [cobalt-security] RaQ1 hacked

["Zeffie" <cobalt-secur@xxxxxxxx>]

>Regarding the sniffing....

>'m not a linux Guru, but I think he should also use SSL for the admin
interface...
infact the admin password for shell access and webadmin are the same... and
if the hacker
is sniffing the port 80 then he will be able to manage his access....thru
Telnet and even SSH...

>My gut instinct on this is that there is a sniffer somewhere between him
and his server -- your advice to him to use SSH instead of telnet would
solve that problem. He should also check his computer for worms/viruses, and
check all of his other servers for interfaces running in promiscuous mode.
He should also get in touch with his ISP and have them look for sniffers.

<Big Big html Big Snip>

My gut feeling is he should also be checking his local computer for
problems... and that he might of been reinstalling old passwords from the
"hacked file"

Those Raq1 to Raq2 updates don't always go the smoothest either....

Zeffie
http://www.zeffie.com/