RE: [cobalt-security] Raq 550 Remote Exploits?

["Keith Ford" <keith@xxxxxxxxxxxxxxxx>]

We had something similar happen a couple of weeks ago on our 550.  Our
sendmail binary got hacked and was ignoring the /etc/mail/access file, which
made us an open-relay.  We caught it but only after 60k messages went out.
While trying to find the problem, our /home disappeared.  Our sysadmin said
that something was "overlaying another partition" and making it disappear,
but it was really still there.  The check root kit found nothing, so we're
not sure what happened.  The spammers were in Korea and we contacted their
ISP.  After that, someone tried to hit us with a DoS attack.  What joy.
Good luck.

-keith