<CONTENT /> v.6

UConn Finds Rootkit in Hacked Server
“The rootkit was first placed on the server during a system compromise on October 26, 2003, but was only detected one week ago, on July 20.

UConn said the attack took advantage of an insecure service for which no vendor patch was available, but stressed that an analysis of the computer showed that that the original compromise was incomplete.“

A couple of things to keep in mind here. First, because the original compromise was incomplete, it most likely means that the rootkit was dropped by some worm exploiting a known weakness, but for some reason failed to fully deploy. In all likelihood, the ‘kit never “called home” so the attacker(s) never accessed the machine. Second, this stresses the need for constant vigilence. The 18 month gap between the intrusion and detection was most likely because the ‘kit was dormant and not giving off any signels of its presence. On the other hand, a sysadmin should know if, in less than 18 months, that there was an unauthorized access to the box.

So, remember folks: keep the firewalls up and limit remote acces to servers.

Our del.icio.us Folksonomy (Beta)
“We’ve just added del.icio.us tags to our articles. These are single keyword categories generated by the O’Reilly readers as they bookmark our articles in del.icio.us. The sum of these tags is a taxonomy (some say folksonomy) of articles that emerged from our readers rather than being handed down by our editors.“

Based on data supplied by del.icio.us, O’Reilly is adding popular folksonomy tags to it’s articles. The tag info will appear in the upper left hand corner of the article. This is a great way to tie content to the broader community and put it in some sort of context.