Article View: comp.os.linux.security
Article #14Re: I think I have been hacked
From: Zebee Johnstone
Date: Mon, 27 May 2002 01:36
Date: Mon, 27 May 2002 01:36
28 lines
1963 bytes
1963 bytes
In aus.computers.linux on Mon, 27 May 2002 06:50:40 +0800 Graham Daniell <gdaniell@wt.com.au> wrote: > >May 26 20:49:41 torvalds network: Bringing up route unknown >succeeded >May 26 20:49:41 torvalds network: Bringing up route eth0 succeeded >It looks to me like someone managed to install a route between my >internal network and an unknown address (probably 195.119.1.180?) Doesn't make sense to me. eth0 isn't a route, it's a network interface... Go to your distribution CD, or a mirror like www.planetmirror.com.au and get a known good copy of lsof. Run lsof -i and see what's listening on your system, identify each program. Run netstat and netstat -rn and make sure all is as it should be. If the versions of ps and netstat disagree with the clean copy of lsof, you're owned. reformat and reinstall. If you can't work out what's listening, you're owned. reformat and reinstall. Zebee
Technical Details
Message-ID:
<slrnaf33hc.c0g.zebee@zipperii.zip.com.au>Path:
arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!newsxfer.interpacket.net!newsfeed.zip.com.au!nasal.pacific.net.au!zebeeReferences:
<3CF166C0.6C6DB09C@wt.com.au>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: 102983,12f974d98d69a93f X-Google-Attributes: gid102983,public X-Google-Thread: 106e9e,12f974d98d69a93f X-Google-Attributes: gid106e9e,public X-Google-ArrivalTime: 2002-05-26 18:38:55 PST Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!newsxfer.interpacket.net!newsfeed.zip.com.au!nasal.pacific.net.au!zebee From: zebee@zip.com.au (Zebee Johnstone) Newsgroups: comp.os.linux.security,aus.computers.linux Subject: Re: I think I have been hacked References: <3CF166C0.6C6DB09C@wt.com.au> Reply-To: zebee@zip.com.au Message-ID: <slrnaf33hc.c0g.zebee@zipperii.zip.com.au> User-Agent: slrn/0.9.5.7 (UNIX) Lines: 28 Date: Mon, 27 May 2002 01:36:41 GMT NNTP-Posting-Host: 61.8.0.87 X-Complaints-To: news@pacific.net.au X-Trace: nasal.pacific.net.au 1022463401 61.8.0.87 (Mon, 27 May 2002 11:36:41 EST) NNTP-Posting-Date: Mon, 27 May 2002 11:36:41 EST Organization: Pacific Internet (Australia)