LinuxQuestions.org
Go Job Hunting at the LQ Job Marketplace
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
LinkBack Search this Thread
Old 04-18-2005, 03:04 PM   #1
PAB
Member
 
Registered: Jun 2003
Posts: 44

Rep: Reputation: 15
Have I been hacked?


I am using Fedora2. It is behind a router. i opened a new non-root account this morning on my system to use for the internet (i had been using root).

i logged in this afternoon with the non-root account. left the system for a while. when i came back, there was a screen with an upside-down smily face (i guess you'd call it a frown) on my system in black and white. i moved the mouse, and the desktop appeared but there was a terminal window there (not like the bash shell but different) that was running commands. the only command that i can remember was "dd" and restart. when I moved the mouse again, the screen vanished and all was well. I WAS NOT ON THE INTERNET AT ANY TIME DURING THIS.

i am thinking (hoping) that this might simply be a hardware/software issue and that some hardware/software requires access to the root account. i'm wondering if linux, if there is a problem, might give a screen that has a frown on it.

if i have been hacked, is there a log where i can see the commands that were being run? any specifics would be greatly appreciated (anything other than "it sounds like you've been hacked").

Thanks everyone,

PAB
 
Old 04-18-2005, 03:18 PM   #2
Ephracis
Senior Member
 
Registered: Sep 2004
Location: Sweden
Distribution: Ubuntu, Debian
Posts: 1,109

Rep: Reputation: 49
Haha, that reminds of a screensaver called BSOD IIRC (Blue Screen Of Death), it comes with xscreensaver. If you are lucky, that's what you saw.
 
Old 04-18-2005, 03:29 PM   #3
PAB
Member
 
Registered: Jun 2003
Posts: 44

Original Poster
Rep: Reputation: 15
Mezzymeat:

Thanks for your quick reply! I feel much better. I did a google search and found the following link:

https://secure.sccs.swarthmore.edu/p...er/002157.html

the person's explanation (below) was exactly what happened to me. I have taken the liberty of removing the expletive from the post! Now, if anyone could explain to me what it all means, that would be great. However, for now (thanks to Mezzymeat), i feel relieved.

My Dell inspron 8000 laptop running debian with 1 2.4.19 kernel
just crashed in a way that was very un linux like. Sadly I was not present
for the entire crash so I don't know the details, but when I returned the
center of the screen was white with text on it (like a sun when you hit
stop-a) and there was a bunch of text that included an error message about
a bad trap. Then the screen said "resetting" and the screen went black
except for a sad computer face (quite a bit like when an old mac booted up
unhappy.) It rebooted OK (ext3 filesystems).

Uhhhhh... I hate to play completely dumb here, but are you sure this
wasn't Xscreensaver's BSOD module?

What happened when you tried to type? (Or did you just hit the power
switch?)

1. What the f*** happened?

Those two things together? The above is all I can think of.

2. How do I keep it from happening again?

Run xscreensaver-demo and uncheck BSOD, if I'm right. Or just know
that your computer does not, have OpenFirmware, and can't spout
messages like a Sun, nor does it have Mac ROMs, so it can't display
the Sad Mac. Well, it can, but it'd all have to be in software...
 
Old 04-18-2005, 06:21 PM   #4
Ephracis
Senior Member
 
Registered: Sep 2004
Location: Sweden
Distribution: Ubuntu, Debian
Posts: 1,109

Rep: Reputation: 49
Quote:
Originally posted by PAB
Now, if anyone could explain to me what it all means, that would be great.
The same thing here, it sounds like the xscreensaver module called BSOD. It is a screensaver that shows different errors and such for *BSD, Mac, Windows, Unix, Linux, etc, etc. It is a very intelligent screensaver that will show your hostname, your login name, etc, in the errors. But do not be fooled! It is just a screensaver, nothing more.

You can check the screensaver by typing xscreensaver-demo at the command line and then check for "BSOD" and press Preview, then I guess you will see if you recognize anything.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Have I been hacked? Please help linuxboy69 Linux - Security 11 09-07-2005 07:20 AM
Hacked? mikeshn Linux - Security 2 03-12-2004 01:57 PM
Help! Have I been hacked? Tenover Linux - Security 1 11-19-2003 03:24 PM
Did we just get hacked? vous Linux - Security 4 11-17-2003 08:11 AM
am i being hacked? tearinox Linux - Security 5 11-13-2003 06:00 PM


All times are GMT -5. The time now is 11:02 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration