Re: Visited by a cracker

From: Alan Hicks (alan_at_lizella.net)
Date: 07/14/04

  • Next message: Christian: "Re: Visited by a cracker" 
    Date: Tue, 13 Jul 2004 18:45:51 -0400
To: Arthur Chan <axc@andrew.cmu.edu>

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    On Jul 13, 2004, at 11:20 AM, Arthur Chan wrote:
    > Is it at all possible that the cracker tampered his .bash_history and
    > left
    > it there to fool you?

    Anything's possible when a cracker's involved, but I wouldn't think
    this is a likely scenario. A good cracker wouldn't have left it so that
    top or ps would show his processes (like the strace), and thus likely
    wouldn't have left the .bash_history around either.

    If you realy want to be paranoid you can wonder if the "break-in" was
    actually performed by some third party who hopes you will suspect this
    user and not him, but realistically this just doesn't happen.

    - --

    It is better to hear the rebuke of the wise,
    Than for a man to hear the song of fools.
    Ecclesiastes 7:5
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.2 (Darwin)

    iD8DBQFA9GYflKR45I6cfKARAkWYAJ0fJhHRhdRo0AzuARsfGgW2V5hEsACfYIIA
    ee3WZ0j+3+JVHn8FHTyHbBI=
    =1wIw
    -----END PGP SIGNATURE-----

  • Next message: Christian: "Re: Visited by a cracker"

    Relevant Pages