Re: ftp server compromised

From: David Hodges <dhodges(at)outermost.com>
Date: Wed Feb 12 2003 - 22:33:18 EST

This happened to us through a carelessly-left-open anonymous account. From your logs, it looks like the same m.o. as the ones who got us. We closed the account and shutdown ftp for a few days, which stopped the activity.

I was able to delete the files by using DOS (i.e. cmd.exe) and using the 8.3 filenames, not the long filenames (try DIR/X to see the short filenames. ). You can use DEL/S to delete a folder at a time.

David Hodges
Outermost Software

At 01:20 AM 2/13/2003 +0000, rbelchez@show-net.net wrote:

>Dear All,

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Thu Feb 13 00:19:29 2003