Re: Found, a new rootkit

[Craig White <craigwhite azapple com>]

On Fri, 2006-03-31 at 13:39 -0600, Les Mikesell wrote:
> On Fri, 2006-03-31 at 13:20, Gene Heskett wrote:
> 
> > >They use these botnets to distribute spam, launch DDOS, or whatever
> > >else their imagination came come up with.  Either of those would
> > >contribute to an increase in bandwidth usage.
> > 
> > Humm, we were in fact subjected to a DDOS attack early last sunday 
> > morning, which lead to the traffic servers demise & rebuild.
> > Got us listed at spamcop & our mail died.
> 
> Or more likely, your box was participating in a DDOS. Do
> you have any idea what exploit might have been used to
> install the programs you found?   
----
My money is on sshd - somebody with a weak password.

Craig