[Full-Disclosure] Jabberstudio.org compromised
From: Devdas Bhagat (devdas_at_dvb.homelinux.org)
Date: 01/29/05
- Previous message: Antonio Henrique Oliveira: "Re: [Full-Disclosure] Transamericana.org"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Sat, 29 Jan 2005 23:21:38 +0530 To: full-disclosure@lists.netsys.com
Just a heads up for everyone:
<quoting jabberstudio.org>
What's Happening?
It has been discovered that the server hosting JabberStudio has been
hacked (cracked if you want to say that) for what appears to be one
year. Careful analysis of logs and other information shows that the
attack was an automated rootkit and it was never used to view or alter
files. Regardless, we feel it is vital that all files be reviewed for
any malicious changes before they are copied over to new machines and
publicly distributed again.
First, we suggest that anyone that has used JabberStudio change their
external passwords, especially if they connected to any machine from the
JabberStudio shell server. All user accounts on the machine have been
suspended until the new machines are finalized, so don't attempt to
change your shell server password.
</quote>
A whole year? Don't these guys use tripwire or aide or equivalent? Or
are they just overloaded with real life?
Devdas Bhagat
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
- Previous message: Antonio Henrique Oliveira: "Re: [Full-Disclosure] Transamericana.org"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
