Re: [TCLUG:21399] script kiddies...

[Eric F Crist <ecrist@ardent-hacker.net>]

script kiddies should be easy to track.  Most of the scripts aren't extensive
enough to wipe out all the log files.  Check your logs and see where they
connected from.

On Mon, 18 Sep 2000, you wrote:
> one of my co-workers, who insists on admining his own box, and keeping it
> out on the internet connection, and not behind my firewall got sploited
> recently.. looks like the t0rn rootkit was used.. has anyone else had any
> kids in their boxes recently?  any luck tracking them?
> 
> Thank You,
>         Ben Kochie (ben@nerp.net)
> 
> *-----------------------*  [ - * - * - * - * - * - * - * - ]
> | Unix/Linux Consulting |  [ Haiku Error Message:          ]
> |  PC/Mac Repair        |  [  Chaos reigns within.         ]
> |   Networking          |  [  Reflect, repent, and reboot. ]
> | http://nerp.net       |  [  Order shall return.          ]
> *-----------------------*  [ - * - * - * - * - * - * - * - ]
> 
>  "Unix is user friendly, Its just picky about its friends."
> 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tclug-list-unsubscribe@mn-linux.org
> For additional commands, e-mail: tclug-list-help@mn-linux.org
-- 
Eric F Crist
System Administrator
Ardent-Hacker.net