3 ms·

Perhaps one would have expected log entries or an updated atime?

• nodata 16y ago
  Someone has root. Everything on the system can't be trusted. The assumption should be the opposite, by default.
  • JoachimSchipper 16y ago
    There's a difference between digital forensics and "the virus scanner says it's clean, let's start loading the credit card data". As a forensics statement, this makes perfect sense - and note that they (say they) have reset all passwords, so it's not like they rely on this.
    • joh6nn 16y ago
      i can verify that i received a password reset email from sourceforge on saturday, that explained there had been an attempt made to get at the passwords, and that rather than wasting time speculating on if they had been compromised, they were just doing a system wide password reset.
  • ams6110 16y ago
    The logs may (should) be on a separate loghost, which is otherwise isolated from the machines it's servicing. Assuming this is the case, and those logs show no evidence of further penetration, that's evidence in favor of the conclusion that the damage was contained. However you're right, once an attacker has root it's very hard to take anything at face value after the fact.