<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.5730.11" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>The guy who hacked me didn't seem too concerned
about not being noticed. The replacement ps would not allow me to kill any
processes (including the ones he was running). There was enough log
information left that I could trace the intrusion and even the ISPs hub it came
from and I reported it to the ISP, although I don't know of they followed it
up. If he was clever, he was going through some innocent person's computer
already, which would have pretty well covered his tracks.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>In this case, there were only three or four
passwords in the system, so I wasn't too worried about that.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Tripwire would be fine, if it had a baseline, but I
don't think its any good after the fact.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Wilton</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV></BODY></HTML>