OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
RE: Exploit or trojan

From: Myers, Mike (Mike.Myersnwdc.ibs-lmco.com)
Date: Fri Dec 19 2003 - 15:56:40 CST


I might point out that the Sun fingerprint database can be of great assistance in a case like this. Sun has provided an interface to check MD5 checksums of all (well, most) binaries they have ever distributed either as patches or as core OS pieces.

The interface isn't great for mass checking of files (web form with max of 255 entries at a time) but it's a place to start:

http://sunsolve.sun.com/pub-cgi/fileFingerprints.pl

Cheers,
 - Mike Myers, Mike.Myers <at> nwdc.net