🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.os.linux.security
Article #5

Re: I think I have been hacked

#5
From: Graham Daniell
Date: Thu, 30 May 2002 13:48
42 lines
2371 bytes
Zebee Johnstone wrote:
> 
> In aus.computers.linux on Mon, 27 May 2002 06:50:40 +0800
> Graham Daniell <gdaniell@wt.com.au> wrote:
> >
> >May 26 20:49:41 torvalds network: Bringing up route unknown
> >succeeded
> >May 26 20:49:41 torvalds network: Bringing up route eth0 succeeded
> 
> >It looks to me like someone managed to install a route between my
> >internal network and an unknown address (probably 195.119.1.180?)
> 
> Doesn't make sense to me.  eth0 isn't a route, it's a network
> interface...
> 
> Go to your distribution CD, or a mirror like www.planetmirror.com.au
> and get a known good copy of lsof.
> 
> Run lsof -i and see what's listening on your system, identify each
> program.
> 
> Run netstat and netstat -rn and make sure all is as it should be.
> 
> If the versions of ps and netstat disagree with the clean copy of
> lsof, you're owned.  reformat and reinstall.
> 
> If you can't work out what's listening, you're owned.  reformat and
> reinstall.
> 
> Zebee

Hi,

Can you explain in more detail what you mean by the following?

> If the versions of ps and netstat disagree with the clean copy of
> lsof, you're owned. 

Do you mean if lsof shows different programs listening?

Regards,
GD
Technical Details
Message-ID: <3CF62D9B.DAF938EF@wt.com.au>
Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!news1.optus.net.au!optus!news.uwa.edu.au!nntp.waia.asn.au!quokka.wn.com.au
References: <3CF166C0.6C6DB09C@wt.com.au> <slrnaf33hc.c0g.zebee@zipperii.zip.com.au>

Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 106e9e,12f974d98d69a93f
X-Google-Attributes: gid106e9e,public
X-Google-Thread: 102983,12f974d98d69a93f
X-Google-Attributes: gid102983,public
X-Google-ArrivalTime: 2002-05-30 06:50:35 PST
Message-ID: <3CF62D9B.DAF938EF@wt.com.au>
Date: Thu, 30 May 2002 21:48:11 +0800
From: Graham Daniell <gdaniell@wt.com.au>
X-Mailer: Mozilla 4.75 [en] (Win95; U)
X-Accept-Language: en,zh-CN
MIME-Version: 1.0
Newsgroups: comp.os.linux.security,aus.computers.linux
To: zebee@zip.com.au
Subject: Re: I think I have been hacked
References: <3CF166C0.6C6DB09C@wt.com.au> <slrnaf33hc.c0g.zebee@zipperii.zip.com.au>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: dsp-202-72-132-108.perth.westnet.com.au
X-Trace: quokka.wn.com.au 1022820446 dsp-202-72-132-108.perth.westnet.com.au (30 May 2002 21:47:26 +0800)
Lines: 42
Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!news1.optus.net.au!optus!news.uwa.edu.au!nntp.waia.asn.au!quokka.wn.com.au