I remember a story of someone that was decommissioning an HP-UX box at a university after years of service doing... not much it seems. While shutting it down th

I remember a story of someone that was decommissioning an HP-UX box at a university after years of service doing... not much it seems. While shutting it down they noticed that the system had been compromised and an investigation began. It turns out the intruder had exploited a remote vulnerability, logged in as a regular user, and had tried to compile a rootkit. After days of attempts to compile the software, the intruder seemed to have found a way to patch the remote vulnerability, and logged out to never return. This is the same thing as security through obscurity or security through lack of usability IMO.