From owner-freebsd-security@FreeBSD.ORG  Thu Dec  1 07:41:19 2005
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
X-Original-To: freebsd-security@freebsd.org
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id C9DCD16A41F
	for <freebsd-security@freebsd.org>;
	Thu,  1 Dec 2005 07:41:19 +0000 (GMT)
	(envelope-from timothy@open-networks.net)
Received: from titan.open-networks.net (ns.open-networks.net [202.173.176.254])
	by mx1.FreeBSD.org (Postfix) with ESMTP id F12C143D72
	for <freebsd-security@freebsd.org>;
	Thu,  1 Dec 2005 07:41:18 +0000 (GMT)
	(envelope-from timothy@open-networks.net)
Received: from [192.168.1.200] (unknown [192.168.1.1])
	by titan.open-networks.net (Postfix) with ESMTP id 12C00B83D;
	Thu,  1 Dec 2005 17:41:23 +1000 (EST)
Message-ID: <438EA922.9030905@open-networks.net>
Date: Thu, 01 Dec 2005 17:41:22 +1000
From: Timothy Smith <timothy@open-networks.net>
User-Agent: Mozilla Thunderbird 1.0.7 (X11/20051130)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: iwan@staff.usd.ac.id
References: <52765.202.65.114.229.1133424317.squirrel@webmail.usd.ac.id>	<438E7375.5030100@open-networks.net>
	<63365.202.65.114.229.1133440742.squirrel@webmail.usd.ac.id>
In-Reply-To: <63365.202.65.114.229.1133440742.squirrel@webmail.usd.ac.id>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: freebsd-security@freebsd.org
Subject: Re: exploiting kernel
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Security issues \[members-only posting\]"
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 01 Dec 2005 07:41:19 -0000

iwan@staff.usd.ac.id wrote:

>I'm sorry my english makes confuse, my email mean:
>I need to know about kernel's freebsd exploiting to
>securing my box. And I need to know how hackers do that
>(and what kind of tools they used) either.
>
>Thanks.
>
>  
>
>>iwan@staff.usd.ac.id wrote:
>>
>>    
>>
>>>Hi,
>>>Can kernel's freeBSD exploited by tools hacking ? If
>>>true,
>>>can I know how to fix this problem, and what tools can do
>>>that.
>>>
>>>Thanks alot
>>>
>>>
>>>
>>>_______________________________________________
>>>freebsd-security@freebsd.org mailing list
>>>http://lists.freebsd.org/mailman/listinfo/freebsd-security
>>>To unsubscribe, send any mail to
>>>"freebsd-security-unsubscribe@freebsd.org"
>>>
>>>
>>>
>>>
>>>      
>>>
>>thats a bit like asking how long is a piece of string.
>>the port chkrootkit can help tell you if a root kit has
>>been installed
>>on your system, thats all i can tell you with the
>>information you gave.
>>
>>    
>>
>
>
>  
>
for security, generally the kernel and base is not the biggest concern, 
it is ports.
read this section on keeping your ports up to date
http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ports-using.html

and this info is on securing the system in general
http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/security-advisories.html
http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/securing-freebsd.html

if you have already been broken into, some details on what happened will 
help us advise you on what they probably used.