Security Incidents: Re: A friend's cable modem Linux machine just got compromised

["William N. Zanatta" <william () veritel com br>]

I'll take my guess: Beastkit. Following, there is an analysis of a RH 
7.2 compromised box, take a look there and compare your friend's system.
http://cert.uni-stuttgart.de/forensics/rootkits/beastkit.en.php

William Zanatta

-=[ "When you know Slackware you know Linux. When you know Red Hat, all 
you know is Red Hat" ]=-

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com