Re: Visited by a cracker

On Wed, 2004-07-14 at 00:45, Alan Hicks wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On Jul 13, 2004, at 11:20 AM, Arthur Chan wrote:
> > Is it at all possible that the cracker tampered his .bash_history and 
> > left
> > it there to fool you?
> 
> Anything's possible when a cracker's involved, but I wouldn't think 
> this is a likely scenario. A good cracker wouldn't have left it so that 
> top or ps would show his processes (like the strace), and thus likely 
> wouldn't have left the .bash_history around either.

What if he did that on purpose? It would be risky, but clever. He could
get away with a jackpot :)