Re: How was my Firewall HACKED???
From: Michael Burnem (nospam@spam.no)Date: 06/23/02
- Next message: M. Buchenrieder: "Re: How was my Firewall HACKED???"
- Previous message: Juha Laiho: "Oddities in "shell" column of /etc/passwd (Was Re: OpenSSH, ...)"
- In reply to: chackerd01: "How was my Firewall HACKED???"
- Next in thread: M. Buchenrieder: "Re: How was my Firewall HACKED???"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: "Michael Burnem" <nospam@spam.no> Date: Sun, 23 Jun 2002 09:31:30 GMT
"chackerd01" <chackerd01@attbi.com> wrote in message
news:eOaR8.284698$352.26630@sccrnsc02...
> Finally got a broadband connection, so I setup an old computer with Red
Hat
> 6.0 (kernel 2.2.5-15) to do firewall and IP masquerading for my local
> network. Everything appeared to be working fine. Port scans from grc.com
> showed all ports as "stealthed". I have ipchains setup to DENY access on
the
> following ports: ftp, telnet, www, imap, smtp, finger, pop-3, auth, 135,
> https, 445, 512, and 5000. I also have all of the daemons in inetd.con
> disabled.
>
> After a couple weeks of 24/7 connection to the internet I noticed several
> status messages on the console (see below). After evaluating them and the
> system, I realized that someone had gained root access through the
internet,
> and made several changes to my system, including loading 2 perl scripts
> (a.pl & tcpscan.pl). I would appreciate the help from anyone who
recognizes
> these methods/symptoms, and suggest how to close the barndoor. Thanks.
>
> Consol messages:
> usermod[6103]: change user 'operator' UID from 11 to 0
> usermod[6104]: change user 'games' UID from 12to 0
> usermod[6105]: change user 'mail' UID from 8 to 0
>
> PAM_pwdb[6687]: password for (daemon/2) changed by ((null)/0)
>
> lockd: connect from unprivileged port: 127.0.0.1: 2082<4>
You are probably running a tonn of services you don't need, and have
probably installed a tonn of programs you don't need!.
Allot of fat to grap on too there!
- Next message: M. Buchenrieder: "Re: How was my Firewall HACKED???"
- Previous message: Juha Laiho: "Oddities in "shell" column of /etc/passwd (Was Re: OpenSSH, ...)"
- In reply to: chackerd01: "How was my Firewall HACKED???"
- Next in thread: M. Buchenrieder: "Re: How was my Firewall HACKED???"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
