OT. Have I been hacked? IRCD?
Rich Burroughs
rich at paranoid.org
Tue Dec 14 07:40:37 UTC 2004
mark wrote:
> I am just trying to figure out if I have to re-install. It look like
> it. Vulnerability in PHP or PHPBB I think.
>
>
> I found the perl script in /tmp
>
> Or maybe secure /tmp and take the below steps.
>
> Thoughts on this all?
It's clearly hacker activity.
Beyond closing whatever vulnerability caused this, have you checked to
see if the system has been trojaned? It's not perfect, but "rpm -Va" is
a quick and dirty way to do it.
A better way is to check using Tripwire or a similar tool, if you
installed one.
Rich
More information about the fedora-list
mailing list