Re: hacked

[urgrue <urgrue@tumsan.fi>]

yes, true. ive already replaced the box with a fresh install, but i am 
just curious to know what happened.


> 
> urgrue wrote:
> 
> > a hacker has planted trojans and messed around with one of my boxes.
> > its off the network, but i want to know what he did.
> > i replaced netstat, ps, lsof (and others) with originals, but nmap
> > shows that ports 1130 and 53228 are open on the box. i can even
> telnet
> > to these ports and get what definitely looks like backdoors.
> > but netstat and lsof cant find anything on these ports.
> > and ps of course doesnt show anything unusual.
> > since ive replaced the binary commands with originals, but these
> ports
> > are still open, presumably some networking related library has been
> > trojaned?
> 
> Or the kernel itself.
> 
> Once a system has been cracked, the only reliable solutions are to
> either revert to a known good backup, or start from scratch[1].
> 
> [1] Literally. Re-installing the OS over an existing filesystem won't
> help if a trojan configuration file has been added; "dot" files in
> root's home directory are a common vector.
> 
> --
> Glynn Clements <glynn.clements@virgin.net>
>