Date: Sun, 11 May 2003 13:03:21 -0500 From: Blaine Kahle <goatee@binary.net> To: Brett Glass <brett@lariat.org> Cc: freebsd-security@freebsd.org Subject: Re: Hacked? Message-ID: <20030511180321.GB37652@binary.net> In-Reply-To: <4.3.2.7.2.20030509110012.03940680@localhost> References: <A695FEAC-8224-11D7-B2CA-000393C94468@sarenet.es> <A695FEAC-8224-11D7-B2CA-000393C94468@sarenet.es> <4.3.2.7.2.20030509110012.03940680@localhost>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, May 09, 2003 at 11:01:21AM -0600, Brett Glass wrote: > At 08:25 AM 5/9/2003, Bjoern A. Zeeb wrote: > > >this asumes that truss is ok ;-) perhaps take the truss from your > >other 4.7 machine ... > > Yes, you do have to be careful of this. I recently investigated a > machine that had been "owned," and when truss was applied to some > commands (e.g. netstat) it produced no output. I'm showing that truss'ing netstat produces no output on several versions of FreeBSD that I have installed. Is this correct behavior? The truss and netstat binaries both check out when compared to the listings at http://www.knowngoods.org/ -- Blaine Kahle blaine@binary.net 0x178AA0E0
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030511180321.GB37652>