OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: rooted by r0x - from address 212.177.241.127
From: Jens Hektor (hektorRZ.RWTH-AACHEN.DE)
Date: Fri Mar 31 2000 - 06:04:05 CST

Hi,

> The ftp to updates.redhat.com was interesting, maybe he
> was going to upgrade bind for me ;-)

have seen this too, AFAIR the attcker was installing
some missing tcl/tk packages to get his BitchX running.

I have seen both, updating your system for his needs
or closing the vulnerability after installing his own
backdoors.

Bye, Jens