[TriLUG] Real world problem

[Michael Mueller]

Dave,

I participate in a local Linux User Group.  Here is a message from that 
group.  This is FYI only in case you are interested.

Mike

On Friday 26 September 2003 14:56, Errol Casey wrote:
> This is on a box that has been root kited (sucKIT) and will be
> reinstalled, but was wondering what this raw
> connection is?
>
> raw        0      0 0.0.0.0:6               0.0.0.0:*               7
> -
> raw        0      0 0.0.0.0:1               0.0.0.0:*               7
> -
> raw        0      0 0.0.0.0:6               0.0.0.0:*               7
> -
>
>
> Anybody know how the backdoor works on this root kit?