[nsp-sec] ACK 16814 : rooted UNIX boxes

[Rodolfo Baader]

Hi

proxy ACK for ASNs:16814

Notifications were sent to the abuse/noc departments.

Regards,
R.


El 28/06/11 06:27, Dirk Stander escribió:
> Hi,
> 
> please find attached a list of compromised servers found
> in an email drop box.  The servers do have a userland root
> kit installed and are running a trojanized ssh/sshd.
> 
> I'm not sure about the initial attack vector.
> 
> The format of the list is:
> <ASN> | <CC> | <IP> | <PTR> | <time GMT> | <SMTP sender> | <AS DESC>
> 
>     kind regards, Dirk Stander (1&1 Internet AG) :.