Re: exploit or human
Jose Maria Lopez Hernandez <[email protected]>
| Newsgroups | gmane.comp.security.incidents |
|---|---|
| Organization | bgSEC |
| Message-ID | <[email protected]> |
El jue, 31-03-2005 a las 17:59 -0300, Eduardo Kienetz escribió: > On Thu, 31 Mar 2005 18:14:49 +0200, Victor Calzado <[email protected]> wrote: > > Hi, > > > > Valentin Avram wrote: > > > > >Hello. > > > > > >Most of the symptoms you describe and the "sudden" falling of more > > >systems does point to a rootkit that was installed on the first > > >compromised machine (FC2). That machine might have been later used to > > >gain access to the other servers in your network. > > ... > > >Also the failure to restart the server > > >usually is a consequence of that. One way to make that sure is to get > > >the hdd from the possibly compromised machine, put it on an offline > > >system which has rkhunter (or other rootkit-detection software) > > >installed and check it. After the signs you described, it quite very > > >probably you'll find a rootkit. > > > > > >RH's before RHEL are ok (from the stability point of view) as long as > > >you keep the exposed services uptodate (recompilation from source). > > >Don't use the old software they come with, cause you might just open a > > >door to your system. > >... > > I'm sorry but probably you will find more infected systems all over your > > network. You will probably need to reinstall every compromised server > > and any content recovered from an "infected" system should be scanned > > for viri and checked for rootkits. > > Run chkrootkit: http://www.chkrootkit.org > > Regards, Or try rkhunter: http://www.rootkit.nl/ It's a more advanced program to detect rootkits than chkrootkit, and can be updated online. Regards. -- Jose Maria Lopez Hernandez Director Tecnico de bgSEC [email protected] bgSEC Seguridad y Consultoria de Sistemas Informaticos http://www.bgsec.com ESPAÑA The only people for me are the mad ones -- the ones who are mad to live, mad to talk, mad to be saved, desirous of everything at the same time, the ones who never yawn or say a commonplace thing, but burn, burn, burn like fabulous yellow Roman candles. -- Jack Kerouac, "On the Road"