hacking security forum

Re: [Full-Disclosure] Removing ShKit Root Kit

From: Paul J. Morris <mole@morris.net>
Date: Mon Dec 22 2003 - 14:49:37 CST

On Mon, 22 Dec 2003 13:52:57 -0600
"Schmehl, Paul L" <pauls@utdallas.edu> wrote:
> This advice is common, and it's always mystified me. Why would you
> want backups of the "data"?
    Because you may not hold a master copy of the data elsewhere or have
made a backup copy yet. There may be data on the compromised machine
that have entered it from the internet such that you only obtain
alternate copies of when you make a backup of the data on that machine.
The current subscriber base for an email listserver (where new subscribe
and unsubscribe requests may have arrived since the last backup) comes
to mind.
-Paul
-------------
Paul J. Morris
Biodiversity Information Manager, The Academy of Natural Sciences
1900 Ben Franklin Parkway, Philadelphia PA, 19103, USA
mole@morris.net 1-215-299-1161 AA3SD PGP public key available

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Received on Mon Dec 22 16:11:32 2003

This archive was generated by hypermail 2.1.8 : Mon Dec 22 2003 - 17:01:01 CST