On Mon, 11 Feb 2002, Rune Henssel wrote: > Anybody know a RootKit called TuxKit1.0 and another kit that creates > the following files: i have seen several of those components installed on an ssh compromised machine (ssh 1.2) from late january, 2002. the pieces were installed in /var/preserve/vbox and /dev/ida/.inet. several of the same pieces. basically r00t is a collection of several older (well known, with bugs fixed) exploits. if you wanna trade MD5 sums, i'd be happy, but this appears to be a pretty run of the mill set of exploits. included, of course, were ssh, sshd and various other trojans. ____________________________ jose nazario joseat_private PGP: 89 B0 81 DA 5B FD 7E 00 99 C3 B2 CD 48 A0 07 80 PGP key ID 0xFD37F4E5 (pgp.mit.edu) ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Mon Feb 11 2002 - 10:51:39 PST