Re: Did i get hacked?

From: Tony Meman (none_at_superig.com.br)
Date: 05/02/03

  • Next message: mario: "Did i get hacked? Resolution." 
    Date: Fri, 02 May 2003 17:13:54 -0300
To: freebsd-security@freebsd.org

    Hi Mario,

    well any strange activity in the system should be taken in consideration
    so I really think you should audit your system.

    You said the reboot ocurred at 0:32am, its a good idea to search for
    files modified around that time. You could use the binary of some
    trustable system just in case /usr/bin/find got trojaned.

    You said you did not find anything in the logs, they could have been
    erased, use chkrootkit to verify if there are wtmp/lastlog entries that
    may have been erased. Chkrootkit is a pretty nice utility and will be
    able to tell you if there're hidden processes running on the system
    (comparing output from ps with /proc entries) and search for well-known
    rootkits. The tool is not perfect but helps a lot, check it out:

    http://www.chkrootkit.org

    Good luck, 

    --
Marcello Azambuja
mario wrote:
 > hello,
 > i have a FreeBSD 4.8-PRERELEASE #0 that i use as a gateway / nat box for
 > my home.
 > It also acts as a dns / mail server to the outside world.
 > I'm using ipf and basically filter for bogus networks on the way in 
and out.
 > I allow everything out keeping state,
 > and allow this in:
 > pass in proto icmp from any to any icmp-type squench group 200
 > pass in proto icmp from any to any icmp-type timex group 200
 > pass in proto icmp from any to any icmp-type paramprob group 200
 > pass in quick proto tcp from any port > 1023 to any port = smtp group 200
 > pass in quick proto udp from any port > 1023 to any port = domain 
group 200
 >
 > on these ports i run qmail and tinydns
 >
 > i was a bit sloppy by leaving these w/out a password
 > figuring they can't login anyway.
 >
 > gtinydns::nnnn:nnnn::0:0:tinydns:/nonexistent:/sbin/nologin
 > gdnslog::nnnn:nnnn::0:0:dns logger:/nonexistent:/sbin/nologin
 > gaxfrdns::nnnn:nnnn::0:0:zone transfer:/nonexistent:/sbin/nologin
 >
 > I've changed this now though i'm still not sure about the implications of
 > this.
 > Also i'm not running tripwire or any other intrusion detection.
 >
 > Here's my problem. When i got up this morning, i noticed that the box
 > rebooted
 > at 0:32 this morning. I have 3 other computers that did not reboot 
leaving me
 > to believe there was no power failure. I looked through all the logs 
seeking
 > clues as to what happened. Hardware failure? It is an old p-75 and 
the hard
 > drive has had issues in udma-2 but has been doing fine for months in pio4
 > mode.
 > I also have a cron job at 0:30 to move the apache logs to a tmp file 
restart
 > apache sleep 5 minutes and then move the tmp file somewhere where 
newsyslog
 > can catch it. According to the logs, apache restarted fine but the 
tmp files
 > never made it anywhere. Again nothing useful in them either.
 >
 > So if this was a hardware failure (harddrive), then any kernel panic
 > statements probably would not make it to the harddrive. So it would be
 > hard to tell. My question is, what if i got hacked? Would there be anyway
 > to find out despite me being totally unprepared for this?
 >
 > That question really messes with my head.
 > Any pointer and/or clue stick treatments would be greatly appreciated.
 >
 > thanx
 >
 > mario;>
 >
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
  • Next message: mario: "Did i get hacked? Resolution."

    Relevant Pages

    • Did i get hacked?
      ... It also acts as a dns / mail server to the outside world. ... I also have a cron job at 0:30 to move the apache logs to a tmp file restart ...
      (FreeBSD-Security)
    • [SUMMARY] Sunfire v880 reboot
      ... are the responses to my post regarding: Sunfire v880 reboot ... I should have mentioned in my original post that this system has been ... take a look in the RSC buffer logs for whatever ... >if your ups has a glitch, you have a power event. ...
      (SunManagers)
    • Re: Troubleshoot Failing Clients Internet Connection
      ... in the logs to indicate a problem. ... All services running except the DRAC card ... I just checked the CPU usage (3 hours after reboot). ... If you log into the server in the morning when there's no Internet access, ...
      (microsoft.public.windows.server.sbs)
    • Re: Server Reboot
      ... Subject: Server Reboot ... >>-none of the standard logs show any intrusion or root log in attempt, ... I have owned this server since new, and this is the first time it has done this. ...
      (freebsd-questions)
    • Re: One of the System Attendants task is blocked. Function: CMonitoringTask::Work
      ... You need to check the logs on your domain controllers as something is wrong ... When this has been rebooted the server works fine ... and reports no errors in the logs after the reboot. ... difference is that the other exchange server is my external SMTP server ...
      (microsoft.public.exchange.admin)