Re: BIND exploited ?

[Rich Puhek <rpuhek@etnsystems.com>]

Andy Bastien wrote:
> 
> Is it really necessary to buy new hard drives?  Is there a reason why
> he can't just reformat his current drives before reinstalling?
> 

One could simply reformat, but I'd strongly consider buying new drives
for several reasons:

   1) Hard drives are one of the more failure-prone components (and,
unless you're running RAID, harder to quickly swap out a failed unit
than a failed power supply or something). As long as the machine is
down, might as well replace the old hard drives with brand new ones.

   2) Good opportunity to re-evaluate your partitioning scheme on the
affected machine. (true, this can be done to some extent by
re-formatting)

   3) Good opportunity to install higher-capacity (and possibly
higher-speed) drives.

And, finally, keeping the original hard drives around may or may not be
useful in studying the intrusion, the effects of the intrusion, and the
tools/methods used.

--Rich

_________________________________________________________
                         
Rich Puhek               
ETN Systems Inc.         
_________________________________________________________