In early February, an intruder came in via a known vulnerability of the system's POP server. But this intruder came back only a couple of times to check his sniffer logs, and then didn't return. He made a careless mistake that made it trivial for us to find all the rootkit programs. And our sniffer picked up the file transfers of his toolkit, so we have all his tools. By attempting to contact domain owners when they learn of defacements, they are doing the right thing .
System administrators have to keep their guard up.
We make a point of announcing these to our users, colleagues, and affected domains, and we report compromises to the CERT Coordination Center and the San Diego Regional Info Watch . We've put up some of the details on our Web site, but we're withholding certain details of the attack and our collected data. We plan to eventually write up the experiment. Hey, that would be telling.