RE: hacked

• Previous message: re re: "hacked"
• Maybe in reply to: re re: "hacked"
• Next in thread: Ion-Mihai Tetcu: "Re: hacked"
• Reply: Ion-Mihai Tetcu: "Re: hacked"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

To: "re re" <qt4x11@linuxmail.org>, <freebsd-questions@freebsd.org>
Date: Sat, 8 Mar 2003 20:02:02 +0100

you should make a copy of your current harddrive, and lock the otherone in a
safe or something , so that you can always make additional copy's.
This requires a same sized harddisk in a other working system..

But that is propably not what you have,

You should check your webserver logs/ftp logs, for bogus entries
Note that firewalling does not prevent webdefacements, why? Well port
80/20/21
is allowed traffic, so people can get in.

IT might be possible that your ftp server got breached, what version did you
run?
What webserver did you run? with php? Is there even the slightest
possibility that
you had rwx settings on the tree where your webfiles are in, so that one
could have written code to it, or even worse, changing your index file.

I had it myself with a bogus Slashdot topic script, that allowed remote
users
to write into my files, one of my includes was overwritten and i got a
website
your.com, instead of my three tabled layout ... oops, was the script and rwx
permissions in the tree..

Goodluck !!

--
Kind regards,
Remko Lodder
Elvandar.org/DSINet.org
www.mostly-harmless.nl Dutch community for helping newcomers on the
hackerscene
-----Oorspronkelijk bericht-----
Van: owner-freebsd-questions@freebsd.org
[mailto:owner-freebsd-questions@freebsd.org]Namens re re
Verzonden: maandag 8 maart 2004 19:56
Aan: freebsd-questions@freebsd.org
Onderwerp: hacked
hello
despite having ipfilter blocking all ports except 80 21 and 22, tripwire,
and scoring 999999 in nmap, my website got defaced.
the box is currently unplugged.  i wanted to know what is the best way to
find out who did it and how they got in, and what to do from here.  tripwire
shows a lot of files changed, most of which could be attributed to cvsup'ing
recently.  any other security precautions to take disaster recovery guides?
i've already changed p/w's on my other boxes.
thanks
--
______________________________________________
Check out the latest SMS services @ http://www.linuxmail.org
This allows you to send and receive SMS through your mailbox.
Powered by Outblaze
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"

• Previous message: re re: "hacked"
• Maybe in reply to: re re: "hacked"
• Next in thread: Ion-Mihai Tetcu: "Re: hacked"
• Reply: Ion-Mihai Tetcu: "Re: hacked"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]