I think I have been hacked

Article View: comp.os.linux.security

Article #10

Back to comp.os.linux.security Previous Next

#10

From: Graham Daniell
Date: Sun, 26 May 2002 22:50

40 lines
2443 bytes

I have a RH 6.2 Linux server (torvalds) which provides internet
connection for my home network of several Win9x PC's and one RH72
PC.

For some time I have been getting attacked by this IP number:

May 26 12:04:35 torvalds in.telnetd[915]: refused connect from
195.119.1.180
May 26 12:19:35 torvalds in.telnetd[921]: refused connect from
195.119.1.180
May 26 18:08:44 torvalds in.telnetd[1069]: refused connect from
195.119.1.180
May 26 18:51:07 torvalds in.telnetd[1087]: refused connect from
195.119.1.180

Last night's message log showed this:

May 26 20:49:41 torvalds network: Bringing up route unknown
succeeded
May 26 20:49:41 torvalds network: Bringing up route eth0 succeeded
May 26 20:49:49 torvalds network: Bringing up route unknown
succeeded
May 26 20:49:50 torvalds network: Bringing up route eth0 succeeded
May 26 20:55:49 torvalds network: Bringing up route unknown
succeeded
May 26 20:55:49 torvalds network: Bringing up route eth0 succeeded
May 26 20:56:00 torvalds network: Bringing up route unknown
succeeded
May 26 20:56:00 torvalds network: Bringing up route eth0 succeeded

It looks to me like someone managed to install a route between my
internal network and an unknown address (probably 195.119.1.180?)

Should I be worried?  (I already am :-(  )

Should I not use my internal network till I reformat and relaod my
RH62 server?

Thks,
Graham Daniell

Technical Details

Message-ID: <3CF166C0.6C6DB09C@wt.com.au>

Path:

arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!news1.optus.net.au!optus!news.uwa.edu.au!nntp.waia.asn.au!quokka.wn.com.au

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 102983,12f974d98d69a93f,start
X-Google-Attributes: gid102983,public
X-Google-Thread: 106e9e,12f974d98d69a93f,start
X-Google-Attributes: gid106e9e,public
X-Google-ArrivalTime: 2002-05-26 15:50:18 PST
Message-ID: <3CF166C0.6C6DB09C@wt.com.au>
Date: Mon, 27 May 2002 06:50:40 +0800
From: Graham Daniell <gdaniell@wt.com.au>
X-Mailer: Mozilla 4.78 [en] (X11; U; Linux 2.4.9-31 i686)
X-Accept-Language: en
MIME-Version: 1.0
Newsgroups: comp.os.linux.security,aus.computers.linux
Subject: I think I have been hacked
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: dsp-202-72-133-182.perth.westnet.com.au
X-Trace: quokka.wn.com.au 1022507382 dsp-202-72-133-182.perth.westnet.com.au (27 May 2002 06:49:42 +0800)
Lines: 40
Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!news1.optus.net.au!optus!news.uwa.edu.au!nntp.waia.asn.au!quokka.wn.com.au