They had already disabled a bunch of stuff and gave me a list of affected files. Now I'm going through the whole server looking for anything that changed in the last 24 hours. Man, there's a bunch.
How do I research a hack tool?
- (drook)
- (9)
- Dec. 30, 2017, 01:53:08 PM EST
Dunno. Contact your computing appliance vendor?
- (Another Scott)
- (1)
- Dec. 30, 2017, 02:07:44 PM EST
Yeah, Dreamhost noticed it about 5 hours before I did
- (drook)
- Dec. 30, 2017, 02:50:04 PM EST
bunch of them out there, also try sans.org thought I saw an article on last mailing
-NT
- (boxley)
- Dec. 30, 2017, 06:23:30 PM EST
Start with the web server logs
- (scoenye)
- (1)
- Dec. 31, 2017, 12:47:31 PM EST
thanks for the tip downloaded kali linux
-NT
- (boxley)
- Dec. 31, 2017, 04:05:36 PM EST
And now a cron exploit?
- (drook)
- (3)
- Jan. 2, 2018, 03:39:23 PM EST
Review at jobs as well
-NT
- (crazy)
- Jan. 2, 2018, 03:53:47 PM EST
Other account's crontab?
- (scoenye)
- (1)
- Jan. 2, 2018, 09:15:49 PM EST
also note /etc/cron.daily cron.weekly cron.motnly and cron.hourly
-NT
- (boxley)
- Jan. 2, 2018, 09:22:39 PM EST