|
So far we know he is somehow gaining root access through mysql to servers
that he targets which run nats. Nats is not the insecure item. Its mysql I believe. Im going throught the c sources tommorrow and ill let you know what the proggie is actually doing.
One thing you always need to make sure of if that any sniffers they installed are killed or made useless.
I found where his sniffer was creating a lock file and I made my own file there that was not readable or writeable with chattr and that cause his sniffer to segfault thus disclosing its location (error message disclosed path to program).
|