Date: Fri, 09 May 2003 11:01:21 -0600 From: Brett Glass <brett@lariat.org> To: "Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net>, Borja Marcos <borjamar@sarenet.es> Cc: freebsd-security@freebsd.org Subject: Re: Hacked? Message-ID: <4.3.2.7.2.20030509110012.03940680@localhost> In-Reply-To: <Pine.BSF.4.53.0305091424480.650@e0-0.zab2.int.zabbadoz.net > References: <A695FEAC-8224-11D7-B2CA-000393C94468@sarenet.es> <A695FEAC-8224-11D7-B2CA-000393C94468@sarenet.es>
next in thread | previous in thread | raw e-mail | index | archive | help
At 08:25 AM 5/9/2003, Bjoern A. Zeeb wrote: >this asumes that truss is ok ;-) perhaps take the truss from your >other 4.7 machine ... Yes, you do have to be careful of this. I recently investigated a machine that had been "owned," and when truss was applied to some commands (e.g. netstat) it produced no output. --Brett
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4.3.2.7.2.20030509110012.03940680>