LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices

Reply
 
Search this Thread
Old 07-05-2004, 05:48 PM   #1
fenice1976
Member
 
Registered: May 2004
Distribution: MDK 9.2 - Kernel 2.4.22mdk
Posts: 108

Rep: Reputation: 15
Have I been HACKED??


I paste here a post made in alt.os.linux.slackware:

Well, let me tell you:

I was browsing my /home/giulio/src/ directory and exactly the directory in
which I had unpacked source code for my Epson drivers.

Well, I was ALSO questioning on an italian linux newsgroup, and a user
replied to me - let's call this user JOE.

Well, the system slows a little...nothing strange here - sometimes it
happens it freezes for few seconds.

I go in the dir called:

giulio@home:~/src/pips-sc980-2.1.2$ ls -l
total 660
-rw-r--r-- 1 giulio users 18852 2001-11-12 00:02 ABOUT-NLS
-rw-r--r-- 1 giulio users 51 2002-10-18 16:20 AUTHORS
-rw-r--r-- 1 giulio users 17992 2001-11-11 15:18 COPYING
-rw-r--r-- 1 giulio users 3517 2002-10-25 05:03 COPYING.KOWA
-rw-r--r-- 1 giulio users 2544 2002-10-25 05:03 COPYING.KOWA.ja
-rw-r--r-- 1 giulio users 26536 2002-10-19 12:56 COPYING.LIB
-rw-r--r-- 1 root root 0 2004-07-05 23:23 Caro
-rw-r--r-- 1 giulio users 342 2002-10-22 08:47 ChangeLog
-rw-r--r-- 1 giulio users 7831 2001-11-11 15:18 INSTALL
-rw-r--r-- 1 giulio users 12069 2004-07-05 23:05 Makefile
-rw-r--r-- 1 giulio users 247 2002-10-22 08:44 Makefile.am
-rw-r--r-- 1 giulio users 11866 2002-10-30 10:28 Makefile.in
-rw-r--r-- 1 giulio users 0 2002-10-18 16:20 NEWS
-rw-r--r-- 1 root root 0 2004-07-05 23:23 Qui
-rw-r--r-- 2 giulio users 20145 2002-10-30 06:21 README
-rw-r--r-- 1 root root 0 2004-07-05 23:23 Spero
-rw-r--r-- 1 giulio users 195 2002-10-19 07:23 acconfig.h
-rw-r--r-- 1 giulio users 36539 2002-10-30 10:26 aclocal.m4
-rw-r--r-- 1 root root 0 2004-07-05 23:23 ciao
-rwxr-xr-x 1 giulio users 38076 2001-11-11 15:18 config.guess*
-rw-r--r-- 1 giulio users 8573 2004-07-05 23:05 config.h
-rw-r--r-- 1 giulio users 8010 2002-10-30 10:27 config.h.in
-rw-r--r-- 1 giulio users 35558 2004-07-05 23:05 config.log
-rwxr-xr-x 1 giulio users 43340 2004-07-05 23:05 config.status*
-rwxr-xr-x 1 giulio users 27845 2001-11-11 15:18 config.sub*
-rwxr-xr-x 1 giulio users 242090 2002-10-30 10:27 configure*
-rw-r--r-- 1 giulio users 3338 2002-10-30 10:26 configure.in
drwxr-xr-x 2 giulio users 4096 2004-07-05 23:05 doc/
drwxr-xr-x 3 giulio users 4096 2004-07-05 23:06 ekpd/
drwxr-xr-x 3 giulio users 4096 2004-07-05 23:06 ekpnavi/
drwxr-xr-x 3 giulio users 4096 2004-07-05 23:07 ekpstm/
-rw-r--r-- 1 root root 0 2004-07-05 23:23 imbattuto,
-rwxr-xr-x 1 giulio users 5598 2001-11-11 15:18 install-sh*
drwxr-xr-x 2 giulio users 4096 2004-07-05 23:05 intl/
-rw-r--r-- 1 root root 0 2004-07-05 23:23 leggere
drwxr-xr-x 2 giulio users 4096 2004-07-05 23:05 lib/
-rw-r--r-- 1 root root 0 2004-07-05 23:23 manchero\ per\ un\ paio\
di\ settimane.\n>\ E
-rwxr-xr-x 1 giulio users 6472 2001-11-11 15:18 missing*
-rwxr-xr-x 1 giulio users 722 2001-11-11 15:18 mkinstalldirs*
-rw-r--r-- 1 root root 0 2004-07-05 23:23 notato
drwxr-xr-x 2 giulio users 4096 2004-07-05 23:05 po/
-rw-r--r-- 1 root root 0 2004-07-05 23:23 premetto
drwxr-xr-x 2 giulio users 4096 2004-07-05 23:05 redhat/
drwxr-xr-x 3 giulio users 4096 2004-07-05 23:05 setup/
-rw-r--r-- 1 root root 0 2004-07-05 23:23 slacky
drwxr-xr-x 2 giulio users 4096 2004-07-05 23:06 src/
-rw-r--r-- 1 giulio users 10 2004-07-05 23:05 stamp-h
-rw-r--r-- 1 giulio users 0 2002-10-30 10:27 stamp-h.in

Look at he files belonging to ROOT.
Well they are all empty documents, the belong to ROOT - though I was logged
as a user, I always log as a user - and their names are WORDS TAKEN FROM A
POST THAT USER JOE HAD JUST WRITTEN IN THE newsgroup!!!!

SO how is possible that suddendly a bunch of empty files belonging to ROOT
were created in a dir while I was logged as a user and their names are
words taken from a post on the usenet?????

I'm in panic.

THAT'S ABSURD. TRUST ME.
 
Old 07-05-2004, 06:15 PM   #2
fenice1976
Member
 
Registered: May 2004
Distribution: MDK 9.2 - Kernel 2.4.22mdk
Posts: 108

Original Poster
Rep: Reputation: 15
Nobody answer????
HEEEEEEELLLPPPP
ANy hint!!! Please!!!!
 
Old 07-05-2004, 07:25 PM   #3
lokee
Member
 
Registered: Feb 2003
Distribution: Gentoo
Posts: 381

Rep: Reputation: 30
Calm down.
There is no doubt to this question... You know it deep down, so why post?
Do you want help securing your box? If so post in the 'Security' forum after some research...

Keep cool.
 
Old 07-05-2004, 08:00 PM   #4
foo_bar_foo
Senior Member
 
Registered: Jun 2004
Posts: 2,553

Rep: Reputation: 51
yes that is very weird - i agree
i don't understand usenet well enough to assist
i have always thought of usenet as a vulnerability mainly to the server not the client
but i have noticed some people with major cracking foo lurking on usenet

i think i might ask these guys first
antionline

other than that i might try to find other people knowledgeable in rootscript exploits
and even try to acquire some current ones and see if they work on my machine

good luck

that wins the prize for the strangest thing i've seen in a while
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Have I been hacked? Please help linuxboy69 Linux - Security 11 09-07-2005 07:20 AM
Hacked? mikeshn Linux - Security 2 03-12-2004 01:57 PM
Help! Have I been hacked? Tenover Linux - Security 1 11-19-2003 03:24 PM
Did we just get hacked? vous Linux - Security 4 11-17-2003 08:11 AM
am i being hacked? tearinox Linux - Security 5 11-13-2003 06:00 PM


All times are GMT -5. The time now is 03:21 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration