Re: Found, a new rootkit

[John Summerfield <debian herakles homelinux org>]

Gene Heskett wrote:

> > ----
> > My money is on sshd - somebody with a weak password.
>
> We found a couple that were downright 
> stupid/dumb/assinine/all_of_the_above.

Since the attacker wrote to /usr I'd be looking at how he got to be root.