Re: hacked

[Bruce Ferrell <bferrell@baywinds.org>]

search google for vsl and vetes

You find like to a pretty nice kit for locating rootkits and the like. 
You don't mention what distro your system is.  Hate to say it but if 
it's RPM based, you can use the -V option to verify every stinking file 
on the system if necessary

urgrue wrote:

> yes, true. ive already replaced the box with a fresh install, but i am 
> just curious to know what happened.
> 
> 
> 
>>urgrue wrote:
>>
>>
>>>a hacker has planted trojans and messed around with one of my boxes.
>>>its off the network, but i want to know what he did.
>>>i replaced netstat, ps, lsof (and others) with originals, but nmap
>>>shows that ports 1130 and 53228 are open on the box. i can even
>>>
>>telnet
>>
>>>to these ports and get what definitely looks like backdoors.
>>>but netstat and lsof cant find anything on these ports.
>>>and ps of course doesnt show anything unusual.
>>>since ive replaced the binary commands with originals, but these
>>>
>>ports
>>
>>>are still open, presumably some networking related library has been
>>>trojaned?
>>>
>>Or the kernel itself.
>>
>>Once a system has been cracked, the only reliable solutions are to
>>either revert to a known good backup, or start from scratch[1].
>>
>>[1] Literally. Re-installing the OS over an existing filesystem won't
>>help if a trojan configuration file has been added; "dot" files in
>>root's home directory are a common vector.
>>
>>--
>>Glynn Clements <glynn.clements@virgin.net>
>>
> -
> To unsubscribe from this list: send the line "unsubscribe linux-admin" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 
>