Linux Security *Need Help, got cracked*

[idea]

Thank you for all the help

I have decided not to format/reinstall the OS, let me explain why

The server software that was compromised (once again, RealVNC) also runs on Windows. Judging by the files that were placed (Trojan .exe files) it seems that the cracker thought it was a windows machine. The file was placed 4 days before I noticed the problem leaving plenty of time for the attacker to run a local root exploit and gain complete control of my machine. It doesn't seem he attempted to do anything beyond downloading the trojan with Firefox and placing it on my KDE desktop.

IN CASE I AM WRONG: My hosts.deny contains "SSHD: ALL" and my hosts.allow contains 4 known ip's, therefore eliminating the crackers chances of getting in through ssh. Root login is diabled. My firewall (a separate machine) blocks most other ports. I have changed my passwords, what else can he do to make use of my machine?

Slackware 11, when released very soon, will be when I reformat. Until then I am on high alert and I will be watching all logs.

I think I'll be okay.

 

[ms526]

Things like these are an inherent problem with Linux. It's got more security holes than a sieve, and should really not be used for live use.

Can be remedied by using windows.

 

[n0cmonkey]

Originally posted by: ms526
Things like these are an inherent problem with Linux. It's got more security holes than a sieve, and should really not be used for live use.

Can be remedied by using windows.

:laugh:

 

[Nothinman]

therefore eliminating the crackers chances of getting in through ssh.

And what if he's setup another way in that's beind hidden by a kernel module?

 

[Joemonkey]

Looks to me like it was just someone trying to hack into a box and setup an FTP to put MP3's for distribution...

 

[idea]

Originally posted by: Nothinman

therefore eliminating the crackers chances of getting in through ssh.

And what if he's setup another way in that's beind hidden by a kernel module?

Perhaps I'm being naive, but wouldn't a module be listed in modules.conf? How else would it load?

 

[n0cmonkey]

Originally posted by: idea

Originally posted by: Nothinman

therefore eliminating the crackers chances of getting in through ssh.

And what if he's setup another way in that's beind hidden by a kernel module?

Perhaps I'm being naive, but wouldn't a module be listed in modules.conf? How else would it load?

It could be hidden in any number of init scripts, a patched init, a patched kernel...

 

[Nothinman]

Perhaps I'm being naive, but wouldn't a module be listed in modules.conf? How else would it load?

No, modules.conf is the configuration file for the module tools, it isn't used to autoload anything. And as n0c said, it could be in any number of places.

 

[idea]

a patched kernel... don't worry about that cause i just built the new 2.6.17.6

I'll take a close look at the init scripts tonight. I understand what you guys are saying and believe me I agree with you. When Slack11 comes out I won't waste any time to reformat but until then I'm feeling kind of lazy. If this was a corp machine it would be a different story but its just a personal box.

 

[nweaver]

Originally posted by: n0cmonkey

Originally posted by: ms526
Things like these are an inherent problem with Linux. It's got more security holes than a sieve, and should really not be used for live use.

Can be remedied by using windows.

:laugh:

:laugh:
:laugh: