Rooted Linux Box Foresensics Questions

From: Nick Lange (nlangeat_private)
Date: Wed Aug 01 2001 - 06:04:48 PDT

  • Next message: Brian Coyle: "Re: Rooted Linux Box Foresensics Questions"

    Well, I thought I was all patched up but I guess I was wrong (or maybe I was
    right and this is something new)
    but as of two days ago I apparently got rooted as this mornings status
    report I have a nice /sbin/a.out waiting for me upon my return from work
    tonight...
    
    anyone know of any single floppy disk distro's designed for forensics
    containing such things as network drivers and fs stuff for mounting and
    transferring information off the machine so I can figure out exactly what
    happneed w/o screwing up evidence? I'm curious how exactly this happened and
    my pseudo-tripwire didn't cover all directories [assuming there's even
    evidence left, I didn't notice it for two days...] but I can't find out till
    tonight when I return from work...(pulled it off the inet this morning tho).
    TIA
    nick
    
    
    -----------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Wed Aug 01 2001 - 21:17:17 PDT