Article View: uk.comp.os.linux
Article #111Re: ppp hanging due to irritating Korean school kids
From: Tim Haynes
Date: Sat, 28 Apr 2001 12:04
Date: Sat, 28 Apr 2001 12:04
24 lines
2683 bytes
2683 bytes
Simon Waters <Simon@wretched.demon.co.uk> writes: [snip] > He was just implying that if the box was hacked and being used to attack > others (There isn't much of value to anyone else on it - even the > software is all freely available) then it might appear to hang the > Internet connection. But there isn't even a hint of anything being > compromised. Read up on some of the assorted rootkits around & abouts. When you find the entries in inetd.conf and inittab that's bad enough, but when you find the kernel module adjusting your very syscalls so that ls, ps and everything won't return any evidence of the compromised files/ports... without needing to replace those binaries... that's truly sickening. IOW, you have to mount the HD from another trusted medium (eg live CD, or a fresh install) before you can *check* it, let alone proclaim it clean. That and let the thing run with a network sniffer on the same hub as well. Paranoid, who me? ;( ~Tim -- Another day, | piglet@stirfried.vegetable.org.uk Another kernel recompile | http://piglet.is.dreaming.org
Technical Details
Message-ID:
<87ofthw7rc.fsf@storm.emcuk.com>Path:
arc1-ca.pugleaf.net!newsfeed.google.com!newsfeed.stanford.edu!news.tele.dk!212.74.64.35!colt.net!newsfeed.icl.net!nntp.news.xara.net!xara.net!gxn.net!news.gradwell.net!nfs2.emcuk.com!spodzone!not-for-mailReferences:
<3AE6D9DD.C739A284@wretched.demon.co.uk> <87k8492h4q.fsf@storm.emcuk.com> <3ae9c8a6.2152815@news.demon.co.uk> <3AEAACB0.B43D10E8@wretched.demon.co.uk>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 10d8ad,4403abd1862fb11f
X-Google-Attributes: gid10d8ad,public
X-Google-Thread: 108f6a,4403abd1862fb11f
X-Google-Attributes: gid108f6a,public
X-Google-ArrivalTime: 2001-04-28 05:07:23 PST
Path: arc1-ca.pugleaf.net!newsfeed.google.com!newsfeed.stanford.edu!news.tele.dk!212.74.64.35!colt.net!newsfeed.icl.net!nntp.news.xara.net!xara.net!gxn.net!news.gradwell.net!nfs2.emcuk.com!spodzone!not-for-mail
From: Tim Haynes <piglet@stirfried.vegetable.org.uk>
Newsgroups: uk.comp.os.linux,demon.ip.support.unix
Subject: Re: ppp hanging due to irritating Korean school kids
Date: 28 Apr 2001 13:04:07 +0100
Organization: What's Organization?
Lines: 24
Message-ID: <87ofthw7rc.fsf@storm.emcuk.com>
References: <3AE6D9DD.C739A284@wretched.demon.co.uk> <87k8492h4q.fsf@storm.emcuk.com> <3ae9c8a6.2152815@news.demon.co.uk> <3AEAACB0.B43D10E8@wretched.demon.co.uk>
Reply-To: Tim Haynes <piglet@stirfried.vegetable.org.uk>
NNTP-Posting-Host: 62.190.249.123
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Trace: purple.gradwell.net 988459642 38824 62.190.249.123 (28 Apr 2001 12:07:22 GMT)
X-Complaints-To: abuse@gradwell.net
NNTP-Posting-Date: Sat, 28 Apr 2001 12:07:22 +0000 (UTC)
X-Face: #VSW`$W9VSODCMa|VI.*1#90p<]FLnir4eWO`ghu'4b:gu68ck)`W<%[7ICq;z:)zfCNK{" _EUd/*pI~zb6cF-Gwd|).]EDMyx9!"_a)oyL6+<+F5u!N8%fBkn'}Ahx84(qUmtPr[/~:<8X+ZA%fU }n\aBfWy/pD04j0e6,%[yB(ZUE0Sd\9D<SNb!*QRRB#wZBiz(83OQUt}$J5H4~m)_QTUXTBDKa/
User-Agent: Gnus/5.090003 (Oort Gnus v0.03) XEmacs/21.1 (GTK)