internet attack

srnerkar1 · 01-07-2006, 02:37 AM

hello everybody,
I am using Redhat Linux,
I have accoured one serios problem. when saw keyboards all lights are blinking i restart my linux server. but while rebooting it shows long problem giving messege regarding the memory location problem..
After i booted, it booted properly but passwd of root was automatically changed so i tried to recover it with single user mode but it doesnt go in single user mode. so i finally recover it with rescue mode.
After login i found in log files someone was logged before 3-4 days from internet on my system similarly not from one ip but from 4 diffrent places. I think they all logged through ssh. so what should i do for that....

similarly if i want to do my system shutdowm or reboot using init 0 or init 6 command it shows following error................

init 0 (enter)
/dev/null
RK_Init:idt=0xc03bc000, sct[]=0345bf0, F**K:can't find kmalloc ()!

same problem accure with init 6....

{ I dont want to mention here F**K }

so what could be the problem.......

thanks in advannce

Keruskerfuerst · 01-07-2006, 02:53 AM

1. Check your server with a rootkitchecker
2. You probably have to reinstall your server.
3. Change all login names and passwords.

unSpawn · 01-07-2006, 04:55 AM

1. Check your server with a rootkitchecker
2. You probably have to reinstall your server.
3. Change all login names and passwords.

If it literally said "FUCK" then you can skip step 1: your box has been cracked: the RK_Init* messages are a dead giveaway the SuckIT rootkit was installed. It is mandatory you have the box repartitioned, reformatted, and installed from scratch to make a clean start. This must be done as quick as possible and there should be no argueing over it's necessity.
- If you don't have a clue of how they got in make a backup of your auth, config and logfile directories, save a process and network connections listing and the contents of the temp directories and partitions where daemons and users are able to write to.
- If you want to make backups, don't backup the kernel, lkm's, libraries or binaries as they might hide other "surprises". Changing all passwords is mandatory as well, as is informing your authorised users the box was cracked. If this box was on a network you don't own, then informing the network admins would be good too.
- When the box comes up after reinstall, raise the firewall so only you have public access, then start hardening the box. Please see the LQ FAQ: Security references for more.

Good luck.

ddaas · 01-07-2006, 06:11 AM

I was also suspicious about SucktIT on one of my servers. It was a false positive. I've heard others too, which said about SuckIT false positive on RHEL.

just to be sure about SuckIT:

Quote:

- The SucKIT rootkit allows an attacker to hide malicious files by giving them a particular ending. The current attacker is hiding code that ends in xrk or mem. To test for the presence of the rootkit, create a file whose name ends in xrk or mem, then execute an "ls -l". If the files you just created are not shown in the output of ls, it means that the rootkit is hiding them, ie. your system is compromised and needs to be rebuilt.

- Change directories to /sbin and execute an "ls -l init" -- the link count should be 1. Create a hard link to init using ln, and then execute the "ls -l init" again. If the link count is still 1, the SK rootkit is installed.

- Rooted systems send usernames and passwords to other compromised machines using TCP port 55, so if you keep records of network connections, traffic to destination port TCP/55 merits further investigation.

More info: http://forums.gentoo.org/viewtopic-t...ighlight-.html
http://www.stanford.edu/services/sec...-6apr2004.html

As a conclusion I would say that you should reinstall the system if you are not 100% sure that everything is clear. Otherwise it is too risky....

ddaas