Well, I'm not a Linux expert by any means, so my methods may be a little arcaine. I actually check my system logs (usually just /var/log/secure & /var/log/messages) once or twice a day for any unusual activity. When I noticed what appeared to be somebody attempting a buffer overflow (I noticed a bunch of junk output in my files) I was pretty sure I'd been hit. I also noticed a few "added user" lines in my secure file. I immediately did a 'w' to see who was online. He was still online. So I typed 'ps -ef' to get the process of his login and 'kill -9'ed it. I next went to /etc/passwd to see if he had entered any accounts, which he did (but convieniently left appended to the bottom of the file), then I deleted them (out of /etc/shadow as well). He also added a group (to /etc/group) and an alias (to /etc/aliases). After that, I just went to my root directory and typed 'ls -alt | more' to see the most recently changed directory. I would then go into that directory and use the same command to find the latest changed directory / file and alter it if necessary. Since I knew the times he attacked, I knew what times to look for in the modification time of the files. I'm sure there is probably some quicker way to get this done, but this is what worked for me. After all that, since I had his ip and domain name, I entered two lines into my /etc/hosts.deny file to hopefully keep him, and most of Moldova / Romania out. :)
Oh, I also shut down my httpd (/etc/rc.d/init.d/httpd stop) since that seemed to be his entry point from what I could tell. I also found just found out that he was from Moldova after I typed in a portion of his domain name and found his isp in Moldova. I then wrote the sysadmins and they told me it was some internet cafe. They seemed concerned at first, but they wrote back again saying they would tell their client to "settle down" (whatever the hell that means).
Does anyone have any experience updating Redhat packages? I did some updating last night of their security patches, but some of them failed.
Thanks,
Jason
>From: "Jerry Z. Yu"
>To: Jason Lynn
>CC: ,
>Subject: Re: [ale] mediaOne modem
>Date: Wed, 9 May 2001 10:09:40 -0400 (EDT)
>MIME-Version: 1.0
>Received: from [208.205.78.62] by hotmail.com (3.2) with ESMTP id MHotMailBCC2A1000059400431E5D0CD4E3E13690; Wed May 09 07:36:49 2001
>Received: from [10.16.190.190] by atl-ptek-fw.tc.netfor jason_lynn_@hotmail.comid KAA29398; Wed May 9 10:09:41 2001
>Received: from punch.premtec.com ([10.16.190.142]) by premess05.premtec.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2650.21)id JGFBKTJ5; Wed, 9 May 2001 10:09:40 -0400
>From z.yu@Ptek.com Wed May 09 07:37:58 2001
>X-X-Sender:
>In-Reply-To:
>Message-ID:
>
>Jason, it would be interesting and informative if you can share more
>details about this hack story: how you notice/detect it, how you trace down the
>track of the intruders and how you recover.
>My neighbor's RH-62 is up on the net for 2 days then his eth0 was switched
>to prosmiscous mode. He is a linux newbie so I believed him it is not him
>who did it on purpose. We didn't try to trace the hacker. I suggested him
>do a reinstall since it was a fresh install anyway, then helped him build
>a ipchains firewall and ssh replace telnet/ftp.
>
>On Tue, 8 May 2001, Jason Lynn wrote:
>
>#Sage,
>#
>#I also live in Duluth and I just got MediaOne (now ATT, but I still have a
>#mediaone.net email addie) cable modem just last week. I absolutely LOVE
>#it... that may be because I have been using 56k dialup for so long though...
>#
>#The guy came to install it (I provided the NIC card), it took about an hour.
># As soon as he left, I rebooted into my Linux partition and set eth0 to
>#DHCP, restarted the network, and everything worked perfect. I have since
>#yanked that NIC out and made a gateway / firewall box that took SOME
>#tweaking, but is seemingly working fine now. Well, fine enough to get
>#hacked by some guy in an internet cafe in Moldova last night (thankfully he
>#wasn't good at covering his tracks!). Seems I need to learn to patch up my
>#Distribution a little better!
>#
>#If you have any questions, feel free to email me...
>#
>#Jason
>#
>#
>#>From: Sage
>#>Reply-To: morrigu_irm@springmail.com
>#>To: ale@ale.org
>#>Subject: [ale] mediaOne modem
>#>Date: Tue, 08 May 2001 13:36:16 -0400
>#>X-Originating-IP: 209.86.28.78
>#>Received: from [130.205.99.162] by hotmail.com (3.2) with ESMTP id
>#>MHotMailBCC179AF000E4004375182CD63A2404F0; Tue May 08 10:36:48 2001
>#>Received: (qmail 3322 invoked by alias); 8 May 2001 17:52:06 -0000
>#>Received: (qmail 3319 invoked by uid 30); 8 May 2001 17:52:05 -0000
>#>Received: (qmail 3314 invoked from network); 8 May 2001 17:52:04 -0000
>#>Received: from blount.mail.mindspring.net (207.69.200.226) by
>#>130.205.99.162 with SMTP; 8 May 2001 17:52:04 -0000
>#>Received: from smui02.slb.mindspring.net (smui02.slb.mindspring.net
>#>[199.174.114.25])by blount.mail.mindspring.net (8.9.3/8.8.5) with ESMTP id
>#>NAA32574for ; Tue, 8 May 2001 13:35:41 -0400 (EDT)
>#>Received: by smui02.slb.mindspring.net id NAA0000026698; Tue, 8 May 2001
>#>13:36:16 -0400 (EDT)
>#>From owner-ale@ale.org Tue May 08 10:38:14 2001
>#>Delivered-To: ale-outgoing@ale.org
>#>Message-ID:
>#>Sender: owner-ale@ale.org
>#>Precedence: bulk
>#>
>#>We are about to go with MediaOne Broadband. Unfortunately, NOTHING decent
>#>is available (ie, Telocity, Speakeasy) in Duluth, so we're stuck with that
>#>or Bell South.
>#>
>#>Question; This docsis modem they use; anyone had any experience, good or
>#>bad with it? We use Slackware and RedHat, and, of course, nobody supplying
>#>fast Internet access out here supports Linux.
>#>
>#>Anything we ought to know?
>#>
>#>Thanks.
>#>
>#>Sage
>#>--
>#>To unsubscribe: mail majordomo@ale.org with "unsubscribe ale" in message
>#>body.
>#
>#_________________________________________________________________
>#Get your FREE download of MSN Explorer at http://explorer.msn.com
>#
>#--
>#To unsubscribe: mail majordomo@ale.org with "unsubscribe ale" in message body.
>#
>
>Jerry Z. Yu +1-404-262-8544 (O)
>Systems Engineer https://punch
>IS Support, Voicecom, www.voicecom.com
>A business unit of PTEK Holdings, Inc. www.ptek.com
>-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-
>Manage all your important communications ==\
>and information in one place using ===> www.orchestrate.com
>Voicecom's Orchestrate service. ==/
>
Get your FREE download of MSN Explorer at http://explorer.msn.com
--
To unsubscribe: mail majordomo@ale.org with "unsubscribe ale" in message body.