Re: port 6051: hacked?
On Sat, 07 Sep 2002 at 10:16:22AM +1000, Jean-Francois Dive wrote:
> at the system call level. Some are really difficult to see, they dump
> the binary on the disk only when they need them then erase them etc..
If they create a file in a directory watched by tripwire (fools) they will
change the inode (date) on that directory and tripwire will flag it. Granted
they could make a file in /tmp (which most sane people with tripwire don't
wget -O - http://www.zionlth.org/~plhofmei/ | gpg --import
XP Source Code: