🚀 go-pugleaf

Camille Keeler wrote:
> 
> Hi all!
> 
> I've been having real security troubles with my Linux system
> at home.  I'm running Red Hat 5.2 with kernel 2.0.36.  A
> few weeks ago, someone hacked into my system and (I think)
> they had boot root access and my password.  By the time I
> figured out that something was wrong, all my log files had
> been over-written and I didn't have the information I needed
> to figure out what went wrong.  It looks like they made a
> fake login binary and wrote it to my /bin/ directory that would
> record all my passwords and would write those passwords to a
> file in my /tmp/ directory.  I saw my password in that
> file written many times over.
> 
> I knew something was wrong when I went to log into my own
> pc one afternoon and couldn't!  That's what signaled me to
> look in the log files.  That's where I noticed that someone
> other than myself was logging into my accounts.  But by the
> time I returned home to investigate, those files had been
> over-written (as I mentioned earlier).  I did notice that
> the xferlog was filled with tons of strange characters
> (came up as a file filled with '@@@@@' characters).
> 
> I think I know how they obtained my passwords, but not how
> they actually hacked into an account in the first place.
> Maybe something called a 'stack overflow' in ftpd?

Yeah, recently someone got a root shell on my room-mate's computer, and
I've been helping him with it. They got into his machine by a buffer
overrun exploit in wu-ftpd.  Although, this person had an account on the
machine, so he only needed to make one attempt. If he didn't he would've
been able to get root in two attempts: 1) to get the ftp account
(wu-ftpd runs under this account for anonymous ftp) 2) use the ftp
account to get root (wu-ftpd runs under root for non-anonymous ftp).

> I would like to know how to prevent this or other
> common attacks in the future.

goto http://www.freshmeat.net/ and search for autorpm.  This package
installs a program that runs every night and downloads the latest redhat
updates, which are often security related patches.

> This is what I did to try and prevent something like this
> from happening again:
> 
> I put an entry for every server (except the ones I use at work)
> in my hosts.deny file.  That way nobody can try to log in from
> machines that I am not familar with.  I changed all my passwords
> and use passwords that would never be guessed or used by SATAN.
> I went through all my directories to search for files that
> were modified around the time that the hack-in occured.  I
> replaced my bad login file with one from my CD.  Everything is
> backed-up; even if someone did something terrible to my computer,
> I could bring my system back up to normal.

The first step is to remove all unecessary services from your
/etc/inetd.conf.
Also you wan't to eliminate any unecessary services from your init
scripts.  You deserve a pat on the back for using tcp wrappers, it's a
great package. I myself have extensive hosts.allow and hosts.deny files.
Also I try to pick totally random passwords (random mixed case letters
w/random numbers).

> 
> I guess I must have upset someone very much.  My computer has
> been on constant attack ever since then.  All from different
> IP's.   I can't even keep up!  They keep trying to login
> and keep getting denyed access.  But I did get this message
> a few days ago in one of my log files:
> 
> Apr  5 23:19:00 ssa58 kernel: Warning: possible SYN flood from 130.102.106.3 on 129.82.XXX.XX:111.  Sending cookies.
> 
> Apr  5 23:19:47 portmap[1856]: connect from 130.102.106.3 to getport(mount
> d): request from unauthorized host

Well, I live in the dorms, and I see several break-in attempts a day.
Most of the time they try telnetting in, then fingering my machine, then
accessing the imap server, then telnetting again. Thanks to tcp wrappers
though, they don't even get access to any of my daemon processes.

> I don't know what a SYN flood is and if there is anything I can do
> to prevent someone from connecting by this method.  It looks like
> simple attacks through telnet have been prevented by filling out
> my hosts.deny file.  I wonder why my computer (of all computers)
> is sooo interesting?

A SYN flood is a DoS (Denial of Service) attack. It involves flooding a
computer with a bunch of malformed packets and swamping the Operating
Systems networking code until the machine crashes. Don't worry though,
the linux kernel has pretty good protection measures against pathetic
attacks like that.

> I guess I wrote this message to try and get some answers to
> my security questions and to try and warn people about some
> Linux attacks that have been happening on campus.  (none of
> the attacks that I have noticed have come from a CSU computer).
> 
> Here is a list of some of the IP's of the machines used to
> attack my Linux system:
> 
> *.skima.is  [212.30.194.*]  this person was bouncing from IP to IP.
> 
> 128.134.171.28

I used to keep track of the attempts made on my computer, but there are
so many, and most of them are from foreign countries. Anyway, it's not
worth my hassle, when it's obvious to me that they don't know what
they're doing. Sorry you had to meet up with someone a little more
intelligent than the average computer vandal.

From what I can tell *.skima.is  [212.30.194.*] is in iceland. Probably
a 15 yr old on a modem. 128.134.171.28 is in korea.

> Is there any way to refuse httpd service to certain servers as well?
> I didn't see any information about this in the man pages.

you can do that by changing the line that reads:

ServerType standalone 

to:

ServerType inetd

I'm not sure exactly about what you would add to /etc/inetd.conf, but it
would be something like this:

http	stream	tcp	nowait	nobody	/usr/sbin/tcpd	/usr/sbin/httpd

> 
> Thanks for reading through all this;  I was very stressed out
> about having lost control of my own computer at home and am
> doing everthing I can to prevent it from happening again.
> I'm not a CS student or anything like that.  So please be
> gentle.
>

No problem, hopefully this will be my profession someday, perhaps it
already is.


> Free phone sex to anyone who can help me out! ;)

LOL
Well I think offering cybersex would be more appropriate here, but
that's OK :)

BTW feel free to email me with any computer security ?'s or whatnot.


> Thanks,
> 
> Camille Keeler
> Dept. of Chemistry
> CSU Ft. Collins, CO 80521



-- 
mAL
---------------------------------
This message has been brought to 
you by the letter "Q" and the number "3".