Re: [cobalt-security] root kitted :(

[jbrownlee@xxxxxxxxxxxxxxx]

	Booting a kernel from ROM doesn't address the system binaries that have
been trojaned. In my experience, you'll need a ROM update patch to
update your kernel to something more recent. You might consider
installing and running a root-kit checker from chkrootkit.org. It may
also aid in recovering any hidden (but not deleted) entries in wtmp,
etc. Check the readme first, however, and note the dependancies on
system binaries that might, themselves, be trojaned. It's also a good
ideato look for services on 'weird' ports. NMAP is an excellent tool for
this purpose.
	Regardless, the way to solve this is the same: install the utilities
from a trusted source over the trojaned ones as a stopgap. Then
depending on how good your backups are and how certain you feel of your
intrusion time, consider a re-install of the core OS.
-- 

						John

John Brownlee
Senior Systems Administrator and "Network" Security Dude
Pima Community College
Phone: x4838