Welcome to Linux Forums!

With a comprehensive Linux Forum, information on various types of Linux software and many Linux Reviews articles, we have all the knowledge you need a click away, or accessible via our knowledgeable members.

Linux Forum ArticlesLinux ForumsLinux Forum DownloadsLinux HostsFree MagazinesJobs
Home|Register|FAQ|Member List|Calendar|Unanswered Posts|Forum Rules|Today's Posts|Advanced Search|
SEARCH FOR IN
Go Back   Linux Forums > GNU Linux Zone > Linux Security
Reload this Page Damn it! So fast my site is hacked.
Linux Forums
Linux Forums
Welcome To The Linux Forums!
Welcome to Linux Forums. We pride ourselves in being one of the largest Linux communities on the web, we encourage you to REGISTER on our forums and participate in the community. There are over 150,000 members ready to answer your questions. JOINING US today will allow you to make new posts, get support, send messages to other members and submit downloads to our downloads directory and many other great features!

Linux Security Discussion about keeping your machines secure, and the crackers out.

Reply
 
Thread Tools Display Modes
Old 07-06-2003   #1 (permalink)
Linux User
 
Join Date: May 2003
Location: Hong Kong, China
Posts: 256
Send a message via ICQ to skyfolly
Damn it! So fast my site is hacked.

How do I noe If there is a thing planted in my system?
__________________
Signature removed by moderator - please see forum rules
skyfolly is offline   Reply With Quote
Old 07-06-2003   #2 (permalink)
Linux Guru
 
Join Date: Oct 2001
Location: Täby, Sweden
Posts: 7,575
Check what processes are running with ps. If you're rooted it might be worse, though. If you suspect that you've been rooted, check and compare the outputs of these commands:
Code:
ls -d /proc/[0-9]* | wc
ps -Am h | wc
You can also check a list of files modifed the last day with this:
Code:
find / -mtime 1 2>/dev/null
Also, check what files have been put in all world writable directories:
Code:
find / -perm -0007 -type d -exec echo {} \; -exec ls -la {} \; 2>/dev/null
Dolda2000 is offline   Reply With Quote
Old 07-06-2003   #3 (permalink)
Linux Guru
 
Join Date: Oct 2001
Location: Täby, Sweden
Posts: 7,575
Oh yeah, I forgot. Almost most importantly, check what processes are running with deleted executables. Remember that there are some kernel processes that don't have executables, like rpciod, kswapd and the like, so don't be too alarmed. This will list you a good list of PIDs doing that:
Code:
for proc in /proc/[0-9]*; do if ls -l $proc/exe 2>/dev/null | grep -q deleted; then basename $proc; fi; done
Dolda2000 is offline   Reply With Quote
Old 07-06-2003   #4 (permalink)
Linux User
 
Join Date: May 2003
Location: Hong Kong, China
Posts: 256
Send a message via ICQ to skyfolly
Phew, I am very confused here, Dolda, Thanks a lot man! you are the man!!!
I decided to reinstall my server all over again, since no data is special in my system. luckily.

dunno why, he or she? just changed my site name to New Linux Era, I am 100% sure I did not change it. and the network went down itself, I had to reset my router and ADSL modem.

__________________
Signature removed by moderator - please see forum rules
skyfolly is offline   Reply With Quote
Old 07-06-2003   #5 (permalink)
Linux Guru
 
Join Date: Oct 2001
Location: Täby, Sweden
Posts: 7,575
I'm guessing that could have been a problem with your modem or router. It has happened once or twice that my switch has stopped routing packages, and once my modem hung as well, so that I needed to restart it (by unplugging the power cable and plug it back in).
Dolda2000 is offline   Reply With Quote
Reply


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off
 

Free Magazines
Cisco News
Receive a free quarterly e-newsletter with exclusive articles on how Cisco IT uses its own products and solutions to enable the business.
subscribe
Systems Management News, the newspaper for IT systems administration and data center managers!
Each issue of Systems Management News is chock-full of news and analysis to help you understand what's happening in your field.
subscribe
The Enterprise Newsweekly
eWeek is the essential technology information source for builders of e-business.
subscribe
Oracle Magazine
Oracle Magazine contains technology strategy articles, sample code, tips, Oracle and partner news, how to articles for developers and DBAs, and more. Oracle (NASDAQ: ORCL) is the world's largest enterprise software company.
subscribe
Total Telecom
Total Telecom is "The Economist of the communications industry".
subscribe
More free magazines »



All times are GMT. The time now is 07:53 AM.




© 2000 - 2008 - All Rights Reserved - Property of  MAS Media

Content Relevant URLs by vBSEO 3.2.0