🚀 go-pugleaf

Camille Keeler <heyjoe1@lamar.ColoState.EDU> wrote:

: fake login binary and wrote it to my /bin/ directory that would
: record all my passwords and would write those passwords to a
: file in my /tmp/ directory.  I saw my password in that
: file written many times over.   

They could have trojaned quite a few of your files and not
just your login...  I would almost suggest a full re-install.
If you haven't been keeping Tripwire records, there is probably
no other way to be sure. :(

: I think I know how they obtained my passwords, but not how
: they actually hacked into an account in the first place.
: Maybe something called a 'stack overflow' in ftpd?

This one has been making a lot of news recently.  

: I went through all my directories to search for files that 
: were modified around the time that the hack-in occured.  I 

If they were somewhat intelligent, they can modify modification times.
Again, unless you have md5/tripwire stamps of the files, you might
not be safe.

: I guess I must have upset someone very much.  My computer has
: been on constant attack ever since then.  All from different
: IP's.   I can't even keep up!  They keep trying to login
: and keep getting denyed access.  But I did get this message
: a few days ago in one of my log files:

Yep, it sounds like you got hit by a script kiddie.  My guess is
that they slid in, then went and told all their friends about their
newest machine they got...

: Apr  5 23:19:00 ssa58 kernel: Warning: possible SYN flood from 130.102.106.3 on 129.82.XXX.XX:111.  Sending cookies.

SYN floods are a flood of "Knock-knock" packets from a remote host.  When
they are sent in a flood, it will deny service to other networking functions.
This is often used as a precursor to connection hijacking.

: Apr  5 23:19:47 portmap[1856]: connect from 130.102.106.3 to getport(mount
: d): request from unauthorized host

Unless you use it (and you shouldn't!) TURN OFF ALL SUN DAEMONS!  I'm
talking about NFS, portmap, and mountd.  These are full of holes!  This
time it got caught, but that may not always be the case...

: I don't know what a SYN flood is and if there is anything I can do 
: to prevent someone from connecting by this method.  It looks like

Your kernel is already configured to prevent SYN attacks.  That is
what that cookie business is about.  By the way, the IP addresses are
easily faked, too.   The hacker could be anywhere, and could only be
one person...

: simple attacks through telnet have been prevented by filling out
: my hosts.deny file.  I wonder why my computer (of all computers)
: is sooo interesting?

Any service that runs through TCP wrappers is protected by that. But
watch out for the others.  For instance, unless you use them, I really
suggest you lose the SUN daemons I mentioned above.  

: my security questions and to try and warn people about some

Much appreciated...  I'll start securing some of my stuff some more...

: Is there any way to refuse httpd service to certain servers as well?
: I didn't see any information about this in the man pages.

Ummm... belay that other suggestion.  It would be better to do that
from inside the HTTPD.conf files.  In there you will find sections
that look like

order deny,allow
deny from all
allow from localhost
allow from holly.colostate.edu

: Thanks for reading through all this;  I was very stressed out
: about having lost control of my own computer at home and am
: doing everthing I can to prevent it from happening again.

Fully understood.  I'm sorry you had to experience this.  If you
need any more help, the community here is more than likely more than
happy to help you... That's the neat thing about Linux. :)

: Free phone sex to anyone who can help me out! ;)

Wow!  I'll have to take a rain check, though... I was going to consume
some pornography, but the needle on my pornograph is broken...

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Michael J. Dwyer                      I doubt, therefore I might be.
mdwyer@holly.ColoState.edu       http://WWW.CS.ColoState.EDU/~dwyer/
Computer Science Major                      Amateur Radio Tech N0ZAP