[blu] Re: [blu] Re: My website was hacked! (fwd)

[bbj at innismir.net (Ben Jackson)]

David Kramer wrote:
> On Wed, 24 Nov 2004 bbj at innismir.net wrote:
>>I think this was posted on FD yesterday.
> 
> 
> What is FD?

Full Disclosure, full-disclosure at lists.netsys.com. for those of you that 
don't know, BUGTRAQ without moderation.

> I'm normally the one yelling at people to do that after their box has been 
> owned, but given that this is a clearly defined exploit that can only run 
> things as wwwrun, and I've defanged the binary he downloaded, and I've 
> already analyzed everything that's changed in the past few days, I'm 
> fairly confident it's safe not to do that.  If all of those things were 
> not true, I would probably shut the box down and post mortem it when I 
> get back (I'm in New York right now).

Your call. Me, I'm a paranoid nut, but thankfully I haven't had to make 
that decision yet, Thank $DEITY. *knocks on wood*


-- 
/"\  Ben Jackson
\ /  bbj <at> innismir.net - http://www.innismir.net/
  X   Member of the ASCII Ribbon Campaign Against HTML Mail
/ \