Originally posted by sneakyimp
Does anyone know how to determine if your computer/server have been compromised? anyone heard about this? i use SSH all day long.
Unfortunately that article is a tad light on technical details...but nowhere in it does it state that SSH itself was directly compromised.
The intruder probed computers for vulnerabilities that allowed the installation of the corrupted program, known as a Trojan horse, in place of the legitimate program.
Doesn't really say if it was SSH that was vulnerable, or another daemon that allowed root access/installation of trojaned sshd. (My money is on sendmail)
I guess we'll have to wait for CERT or Secunia or whoever to catch wind :/
The operation took advantage of the vulnerability of Internet-connected computers whose security software had not been brought up to date.
Sounds like whatever it was has been patched already, it's just another case of outdated software being vulnerable.
