Re: Can anyone explain this compromise?

[Luke Dudney <luke.dudney () WN COM AU>]

See http://www.cert.org/tech_tips/root_compromise.html

Luke.

> -----Original Message-----
> From: Sir Scriptzalot [mailto:sir_scriptzalot () HOTMAIL COM]
> Sent: Friday, August 11, 2000 4:17 AM
> To: INCIDENTS () SECURITYFOCUS COM
> Subject: Can anyone explain this compromise?
>
>
> Hi all,
>
> We have been receiving messages like below from sites
> around the world warning us that "ourhost.dom.com.au" has
> been compromised. Here is one of the messages:
[snip]
> Other messages are exactly the same but in adition include
> stuff like "you have been r00ted and trojan login, ps, su
> binaries inserted"
>
> Any ideas?
>
> Thanks,
> Max
>
> Max Steel
> Omega-Xpress