Re: [cobalt-security] root kitted :(

["Taco Scargo" <taco.scargo@xxxxxxx>]

What you asked for is unchanges programs. By installing the RPMS (again) you
restore the original versions. That's what you wanted, didn't you ?

Anyway, if I were you, I'd store my data somewhere safe and restore the box.

Taco
----- Original Message -----
From: "Christopher Lange" <lists@xxxxxxxxxxxxxxxxxxxxxxxxxx>
To: <cobalt-security@xxxxxxxxxxxxxxx>
Sent: Sunday, December 02, 2001 22:09
Subject: Re: [cobalt-security] root kitted :(


> Taco,
>
> By reinstalling these RPMS' from the ftp site, would we need to reinstall
> any packages such as the kernel package that was distributed?
>
> --
> Christopher Lange
>
> ----- Original Message -----
> From: "Taco Scargo" <taco.scargo@xxxxxxx>
> To: <cobalt-security@xxxxxxxxxxxxxxx>
> Sent: Saturday, December 01, 2001 2:18 PM
> Subject: Re: [cobalt-security] root kitted :(
>
>
> Get the rpms and install them with rpm -U --force  from
> ftp.cobaltnet.com/pub/products/raq4/RPMS
> See what rpm you need with rpm -qif /path/to/file
>
> With regards,
>
> Taco Scargo
> Professional Services Manager, EMEA
>
> Sun Microsystems
> Sun Cobalt Server Appliances
> ----- Original Message -----
> From: "Mike Jeffers" <mjeffers@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
> To: <cobalt-security@xxxxxxxxxxxxxxx>
> Sent: Saturday, December 01, 2001 5:41
> Subject: [cobalt-security] root kitted :(
>
>
> > I have reason to believe that I am a victim of a root kit and have false
> > copies of the following binaries:
> >
> > w
> > ps
> > ls
> >
> > I have since thrown up a few ipchains rules as a temporary stop gap, but
> > would like to further investigate the perpetrator's kit before I format
> > and restore. Without having good copies of these files, finding where
> > on my file system he dropped off his kit is like looking for a needle
> > in a hay stack.
> >
> > I'm looking to get known good copies of these binaries, could anyone
lend
> > a hand and get me good copies? (I'm on a RaQ4, BTW)
> >
> > Many thanks in advance,
> >
> > -Mike
> >
> > _______________________________________________
> > cobalt-security mailing list
> > cobalt-security@xxxxxxxxxxxxxxx
> > http://list.cobalt.com/mailman/listinfo/cobalt-security
> >
>
> _______________________________________________
> cobalt-security mailing list
> cobalt-security@xxxxxxxxxxxxxxx
> http://list.cobalt.com/mailman/listinfo/cobalt-security
>
>
> _______________________________________________
> cobalt-security mailing list
> cobalt-security@xxxxxxxxxxxxxxx
> http://list.cobalt.com/mailman/listinfo/cobalt-security
>