OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
FreeBSD Security Archives: Re: Strange things on my computer /

Re: Strange things on my computer / Help


Bert Kellerman (bertkebellsouth.net)
Fri, 29 Oct 1999 18:36:38 +0000


FYI
Here is a pretty good general guide by CERT on what action to take after
your UNIX box has been compromised.

http://www.cert.org/tech_tips/root_compromise.html

Bert

Beck David wrote:

> This is the first time I write to the list, Big Hello To All,
>
> I administer a host on the Internet which basically doesn't really
> do anything. I installed some services like www,ftp,ssh,qmail
> / no big deal.
>
> I started playing with this machine 10 month ago. Since that I found
> a handful of strange thingies:
>
> - my wtmp files turn on each month, but after a short while allways
> gets corrupted
> - if I run who, it doesn't show any user
> - if I run last, it shows a big pile of garbage
> - I filter out ICMP totally, which is OK for me
> - but the kernel complains in every 10 minutes for some _out_ going
> ICMP packets, which goes to two hosts. I am absolutely sure
> that nor me nor any of my programs has nothing to do with that hosts
> - when I found this I started to look for the program which generates
> the ICMP packets but I didn't find anything
> - I checked the cron rules, but I didn't find anything
> - then I turned off the setuid bits from nearly every program on my
> host including ping and traceroute, but didn't help
>
> Do you guys suspect that my machine got exploited ? /I do, but I can't
> prove it./
>
> Any ideas ?
>
> Thx, David.
>
> To Unsubscribe: send mail to majordomoFreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message

To Unsubscribe: send mail to majordomoFreeBSD.org
with "unsubscribe freebsd-security" in the body of the message



This archive was generated by hypermail 2.0b3 on Fri Oct 29 1999 - 13:40:23 CDT