has my 10.1-RELEASE system been compromised

Mark Felder feld at FreeBSD.org
Thu Feb 26 18:03:00 UTC 2015



On Wed, Feb 25, 2015, at 14:19, Walter Hop wrote:
> 
> Example:
> # touch -t 201501010000 foo
> # find / -user www -newer foo
> 
> If you don’t find anything, look back a little further.
> Hopefully you will find a clue in this way.
> 

Thanks for posting this trick -- I've never considered it before and
will certainly put it in my toolbox!


More information about the freebsd-security mailing list