Ricci, Could it have been a nameserver compromise? They may have modified the zone file, and replaced it. It would certainly explain the total lack of evidence... and also the 'round' number you reported the server was 'defaced' for. 15 minutes could well be the nameserver TTL etc... my thoughts anyway... BluRRed http://travel.yahoo.com.au - Yahoo! Travel - Got Itchy feet? Get inspired! ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Wed Sep 12 2001 - 10:33:20 PDT