[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Hack attempt

To: focus-linux@securityfocus.com
Subject: Re: Hack attempt
From: John <3v1l.hax0r@gmail.com>
Date: Fri, 23 Jul 2004 15:17:08 -0700
Delivered-to: shane@homeo.stud.ntnu.no
Delivered-to: mailing list focus-linux@securityfocus.com
Delivered-to: moderator for focus-linux@securityfocus.com
In-reply-to: <1090545418.3081.206.camel@lorien.secureideas.net>
List-help: <mailto:focus-linux-help@securityfocus.com>
List-id: <focus-linux.list-id.securityfocus.com>
List-post: <mailto:focus-linux@securityfocus.com>
List-subscribe: <mailto:focus-linux-subscribe@securityfocus.com>
List-unsubscribe: <mailto:focus-linux-unsubscribe@securityfocus.com>
Mailing-list: contact focus-linux-help@securityfocus.com; run by ezmlm
References: <20040721170230.3e78829b.norbert.crettol@idiap.ch> <1090545418.3081.206.camel@lorien.secureideas.net>

Hi,

This is a "root kit" downloaded to wipe the logs, set up IRC server,
replace BIND, etc.
psybnc is described here: 
http://216.239.39.104/translate_c?hl=en&u=http://www.netknowledgebase.com/tutorials/psybnc.html&prev=/search%3Fq%3Dc-leet.dir%26hl%3Den%26lr%3D%26ie%3DUTF-8%26sa%3DG

You should wipe the machine and reinstall.  Then keep PHP, Apache,
Linux patches up to date.  Try to run apache as an account that can't
run wget and other system utilities.
Maybe run the Bastille scripts.  Here is one description of them:
http://www.sans.org/rr/papers/32/195.pdf

References:
- Hack attempt
  - From: Norbert Crettol <norbert.crettol@idiap.ch>
- Re: Hack attempt
  - From: Kevin Johnson <kjohnson@secureideas.net>

Prev by Date: Re: Hack attempt
Next by Date: Re: Hack attempt
Previous by thread: Re: Hack attempt
Next by thread: Re: Hack attempt
Index(es):
- Date
- Thread