Monitoring a file?

[Lowell Gilbert]

"Cordula's Web" <cpghost at cordula.ws> writes:

> I've finally found the culprit with a traditional method:
>   * md5 (binary from an uncompromised machine) on all files
>   * reinstalling from scratch (not buildworld, but really
>     installing from FTP)
>   * md5 again and diff.

[snip]

> Ugh... system clean again at last. :)

You can't be sure.  The attacker probably put an suid binary somewhere
besides the normal system binaries, in which case it's still there and
you may still be vulnerable.  When you know you've been hacked, you
need to wipe the disk and *really* reinstall from scratch.  And be
very careful about what you restore from backups, too.