Linux

Ask something
Discussion Locked

Hacked Linux Box

0 helpful
6 replies

by techstop

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Someone hacked my Linux box. I was on it at the time, and saw scripts running that shouldn't. I started killing them, and tried killing as many processes that they were running as possible (some were doing installs). I didn't get a record of everything that happened.

Eventually, I had to restart the machine.

When it came back up, it had trouble, and wasn't doing any system logging.

I installed a new sysklogd package using --force (because original attempts to reinstall failed with complaint about a file needed by another version---which wasn't running and couldn't be started).

How can I find what else needs to be reinstalled?

6 replies

by timthetoolman

Hi,

The long and short of it is that you can never be certain you have a clean install without reformatting and doing a reinstall.

Whoever hacked your box could have made any number of subtle "additions", adding backdoors and stuff.

If it were me? I'd be starting again from scratch. And adding a firewall this time!

Cheers,
Tim.

by shanghai sam

I was figuring this was going to have to happen, but I was hoping not. I also wanted to use this as an oppurtunity to learn more. I've pretty much figured out it was an attack on wu-ftpd that got him in. I usually don't leave it running, but was moving files. Now I'm trying to figure out how I'm going to *securely* handle ftp because I will have people who need to do it.

by lintadsl

Did you look at your message log who/where hacked from and what she/he did?

To find out what is missing or wrong, you need to run each programs you need.

I would see message log to check any thing going on and see ps -ef to kill some thing youdon't know or shouldn't run.

As answer 1, you should have ipchains or iptables installed and run and use ssh instead telnet.

if you need more help, let us know.
Sunny,

by shanghai sam

I did find that it was some kind of hack started by dropping files via anonymous ftp. It looks like it ran scripts to replace tools like ps and netstat, etc., so I doubt I would find anything with ps -ef. Even though I already knew (but wasn't following this commonsense rule due to problems I should have fixed earlier) what you said about ipchains/iptables/ssh, since this is a true statement, I don't want to rate it "unacceptable".

by techstop

I should add that I've almost resigned myself to reinstalling the box. I had disabled the ipchains because something wasn't working right with them. Normally I leave wu-ftpd disabled, but was uploading files, so it was on for a few hours. The only log entry that looks abnormal is that someone made an anonymous FTP connection. What tipped me off was a failed attempt to send my config files, /etc/passwd, and the shadow file to danceboy@dance.net. I'm guessing script kiddie, who was stopped cold when some of the script failed to work as he expected (because I killed processes). The reason for posting this question was a) to try to stop from having to reinstall from scratch, since I've just done a lot of work on the box in the last couple days, and b) to learn something about doing the forensic work now that the attack has occurred. I want to rate both answers I already got and award points to each, but it appears the question will be closed then. These answers aren't wrong, but didn't add anything to what I already knew myself; don't want to NOT award points for right answers, but want to leave question open awhile to see if something new is learned.

This discussion is closed to new replies.