Hello all... First time posting to the list here... One of our customers who we do security services for when they are needed recently had a Solaris 7 box compromised. There appears to be a rootkit installed that opens an ssh daemon on port 27354 with a sshd_host_key.pub of: ...root@NoraD has anyone seen this before? or has any info on it? ie, what binaries have been trojaned, what files have been replaced, etc.?? Thanks, Shawn Duffy
This archive was generated by hypermail 2b30 : Wed Jun 06 2001 - 13:41:52 PDT