I've changed my mind - ravenblack.net does not appear to require a full reinstall, due to the sheer excellence of FreeBSD. The stupid accounts are now locked closed, all the non-stupid passwords have been changed, and there's even a lovely firewall just in case some daft hax0ring backdoors were left open. Which I'm pretty sure they weren't.
However, it was confirmed that the box had been rooted, thanks partially to the blog. It was Saturday night when the box was suspiciously inactive, yet with no gap in the logs. The time-stamps on my Saturday blog entries are correct. But look at the first Sunday blog entry - 7:30am. Who would believe that I would be awake at 7:30am? Not me. So, the computer magically lost ten hours coincidentally during the time when nobody could connect, and the log was presumably conveniently erased. I'm inclined to believe that there's a hacking group, rather than a single hacker, making the rounds. This time-stamp thing is far clumsier than the original hacker. On the other hand, maybe unfamiliarity with BSD just left him panicking.
[14:01]
|