If my machine's been hacked into, how do I confirm it?

[civad]

Here's the story in a nutshell:

Friday evening, I was upgrading gentoo on my laptop. Since its a PII 400/192 MB RAM, I just let it do its work (not logged in as root, used sudo) and I went to bed. Sat morning, I woke up, and found that my user ID had been changed, I could not log in as root, and when I rebooted, I could not login as a normal user either. I used knoppix to find out which files had been altered/deleted/addes, and also checked the logs (esp. /var/log/messages). There was nothing I could find I checked /root, /home/user and /etc folders especially.

Since I had nothing important on the machine, I formatted the drives and installed debian woody. Changed from 'woody' to 'unstable' in /etc/apt/sources.lst' , and did a dist-upgrade AS ROOT. This was just to find out what was going on. Guess what? Same thing happened. I had the same login ID, but different passwords for root and user this thime (though it shoudln't matter in this case, right?)

I tried looking for any files or logs again, but no luck. Unfortunately, since I have to take the laptop to work on Monday, I had to install linux on it again. This time, I tried Slackware, and I haven't logged on to this machine as root or used sudo. The machine seems to be doing fine till now.

My question is:
a.If we consider that gentoo has a bug which caused the user ID to change/passwords to change, how can the same thing happen in debian also? In that case, is the bug related to an application? (I have tried looking at the mailing lists/forums for gentoo, but not debian.)
b. Is it too much of a coincidence that someone broke into my machine twice within a span of 24 hours?
c. What files/logs should I look into/for to find out if my machine has been compromised?
d. Would having a HW firewall/router help?

Thnx,

Civ

 

[drag]

That is very weird.

Never had something like that happen before...


I suppose it was possible that you got something weird installed on your machine, but I doubt it. If your worried then boot up with Linux cd and zero out your harddrive, "dd if=/dev/zero of=/dev/hda".

That will write over the entire thing with zeros. It probably take a hour or so, depending on how fast/big your HD is.

Maybe something happened in the translation between password scemes. Like if you set the password file to shadow passwords or set up blowfish entcryption from something was md5 or something like that. I don't know.

If you used invalid characters in your username.. Everything should be lowercase and no weird characters. Passwords of course should be the weird with upper/lowercase and the ##$%^476/}}{ type stuff.

You didn't use the same password for both installations? Lots of times people use the same password for lots of different things. Could be someone you know pranking you, or maybe you used the password in a webpage that's doesn't use encrypted connections. Since you take it to work, someone could try to be targeting you to get access if you take you laptop to work. Do you use the same passwords at work as home?

I don't know. Sounds like more of a bug then a hacking attempt though.

 

[drag]

Oh, I don't know if this applies, but if your trying to save a home folder or something thru both installs, then you have to do a chown -R username:groupname /your/home/folder/. Just to get the permissions set up back the way they were before.

 

[civad]

Thanks drag..

I used different passwrods for root and user (i.e 4 totally different passwords)
I talked to a few linux users at my LUG. They said they had heard about it for the first time too.

As far as using my laptop in the office is concerned, it is a non-issue now.

Thanks anyways!

 

[Coldfusion]

You can also enable logging on your firewall and see what's coming in/going out. While it may not tell you if you were hacked for certain, it'll tell you what's talking to your machine.