Article View: comp.os.linux.security
Article #5Re: I think I have been hacked
From: Graham Daniell
Date: Thu, 30 May 2002 13:48
Date: Thu, 30 May 2002 13:48
42 lines
2371 bytes
2371 bytes
Zebee Johnstone wrote: > > In aus.computers.linux on Mon, 27 May 2002 06:50:40 +0800 > Graham Daniell <gdaniell@wt.com.au> wrote: > > > >May 26 20:49:41 torvalds network: Bringing up route unknown > >succeeded > >May 26 20:49:41 torvalds network: Bringing up route eth0 succeeded > > >It looks to me like someone managed to install a route between my > >internal network and an unknown address (probably 195.119.1.180?) > > Doesn't make sense to me. eth0 isn't a route, it's a network > interface... > > Go to your distribution CD, or a mirror like www.planetmirror.com.au > and get a known good copy of lsof. > > Run lsof -i and see what's listening on your system, identify each > program. > > Run netstat and netstat -rn and make sure all is as it should be. > > If the versions of ps and netstat disagree with the clean copy of > lsof, you're owned. reformat and reinstall. > > If you can't work out what's listening, you're owned. reformat and > reinstall. > > Zebee Hi, Can you explain in more detail what you mean by the following? > If the versions of ps and netstat disagree with the clean copy of > lsof, you're owned. Do you mean if lsof shows different programs listening? Regards, GD
Technical Details
Message-ID:
<3CF62D9B.DAF938EF@wt.com.au>Path:
arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!news1.optus.net.au!optus!news.uwa.edu.au!nntp.waia.asn.au!quokka.wn.com.auReferences:
<3CF166C0.6C6DB09C@wt.com.au> <slrnaf33hc.c0g.zebee@zipperii.zip.com.au>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: 106e9e,12f974d98d69a93f X-Google-Attributes: gid106e9e,public X-Google-Thread: 102983,12f974d98d69a93f X-Google-Attributes: gid102983,public X-Google-ArrivalTime: 2002-05-30 06:50:35 PST Message-ID: <3CF62D9B.DAF938EF@wt.com.au> Date: Thu, 30 May 2002 21:48:11 +0800 From: Graham Daniell <gdaniell@wt.com.au> X-Mailer: Mozilla 4.75 [en] (Win95; U) X-Accept-Language: en,zh-CN MIME-Version: 1.0 Newsgroups: comp.os.linux.security,aus.computers.linux To: zebee@zip.com.au Subject: Re: I think I have been hacked References: <3CF166C0.6C6DB09C@wt.com.au> <slrnaf33hc.c0g.zebee@zipperii.zip.com.au> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit NNTP-Posting-Host: dsp-202-72-132-108.perth.westnet.com.au X-Trace: quokka.wn.com.au 1022820446 dsp-202-72-132-108.perth.westnet.com.au (30 May 2002 21:47:26 +0800) Lines: 42 Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!news1.optus.net.au!optus!news.uwa.edu.au!nntp.waia.asn.au!quokka.wn.com.au