Re: Have I been hacked?

Brian writes: > On Tue 06 Jan 2015 at 19:47:09 +0100, Martin Steigerwald wrote: > >> Am Dienstag, 6. Januar 2015, 21:51:26 schrieb Danny: >> > Hi guys, >> > >> > I am afraid my happiness was short lived. To test if the deletion of the >> > file (and the effects thereof) would be permanent I rebo

Re: Have I been hacked?

Hello!! While I am not an expert on the other issues on your machine, I would recomend a wipe and a clean reinstall. Those root files with the random characters are what an asian language font typing system rendered into the standard qwerty would look like (lots of experience). My quick gut instin

Re: Have I been hacked?

On 01/06/2015 11:42 AM, Martin Steigerwald wrote: Am Dienstag, 6. Januar 2015, 20:04:56 schrieb Danny: Hi guys, Hi Danny! A while ago I posted a question about SFTP (I think the thread name was "SFTP Question") about attacks I got against my server after syslog warned me about an attempted b

Re: Have I been hacked?

On Tue 06 Jan 2015 at 20:28:04 +0100, Martin Steigerwald wrote: > Am Dienstag, 6. Januar 2015, 19:20:20 schrieb Brian: > > On Tue 06 Jan 2015 at 19:47:09 +0100, Martin Steigerwald wrote: > > > Am Dienstag, 6. Januar 2015, 21:51:26 schrieb Danny: > > > > Hi guys, > > > > > > > > I am afraid my hap

Re: Have I been hacked?

Am Dienstag, 6. Januar 2015, 19:20:20 schrieb Brian: > On Tue 06 Jan 2015 at 19:47:09 +0100, Martin Steigerwald wrote: > > Am Dienstag, 6. Januar 2015, 21:51:26 schrieb Danny: > > > Hi guys, > > > > > > I am afraid my happiness was short lived. To test if the deletion of the > > > file (and the ef

Re: Have I been hacked?

On Tue 06 Jan 2015 at 20:09:00 +0100, Hans wrote: > Am Dienstag, 6. Januar 2015, 13:33:50 schrieb Jerry Stuckle: > > > > One other suggestion I might make is rkhunter (apt-get install > > rkhunter). While not perfect (what is?), it does scan your system for a > > number of different compromises.

Re: Have I been hacked?

On Tue 06 Jan 2015 at 19:47:09 +0100, Martin Steigerwald wrote: > Am Dienstag, 6. Januar 2015, 21:51:26 schrieb Danny: > > Hi guys, > > > > I am afraid my happiness was short lived. To test if the deletion of the > > file (and the effects thereof) would be permanent I rebooted the system and > >

Re: Have I been hacked?

Am Dienstag, 6. Januar 2015, 13:33:50 schrieb Jerry Stuckle: > On 1/6/2015 2:53 PM, Danny wrote: > >> A stab in the dark, but is it possible this machine has services exposed > >> to the internet, and you'd not applied fixes against the recent > >> shellshock bug?> > > Jip ... ssh, apache, postfix

Re: Have I been hacked?

On 1/6/2015 2:53 PM, Danny wrote: >> A stab in the dark, but is it possible this machine has services exposed to >> the internet, and you'd not applied fixes against the recent shellshock bug? >> > > Jip ... ssh, apache, postfix, popa3d ... come to think of it ... all the candy > is available ...

Re: Have I been hacked?

Am Dienstag, 6. Januar 2015, 21:51:26 schrieb Danny: > Hi guys, > > I am afraid my happiness was short lived. To test if the deletion of the > file (and the effects thereof) would be permanent I rebooted the system and > consequently found another file (same size, same random lettering) booted > u

Re: Have I been hacked?

> A stab in the dark, but is it possible this machine has services exposed to > the internet, and you'd not applied fixes against the recent shellshock bug? > Jip ... ssh, apache, postfix, popa3d ... come to think of it ... all the candy is available ... lol ... -- To UNSUBSCRIBE, email to de

Re: Have I been hacked?

Hi guys, I am afraid my happiness was short lived. To test if the deletion of the file (and the effects thereof) would be permanent I rebooted the system and consequently found another file (same size, same random lettering) booted up with everything else. :( ... The culprit is well hidden and reg

Re: Have I been hacked?

> From: Simon Brandmair >To: debian-user@lists.debian.org >Sent: Tuesday, 6 January 2015, 16:53 >Subject: Re: Have I been hacked? > > >On 01/06/2015 09:10 AM, Danny wrote: >[...] >> However, prior to this breakin, in early December 2014, I noticed my network &g

Re: Have I been hacked?

On 01/06/2015 09:10 AM, Danny wrote: [...] > However, prior to this breakin, in early December 2014, I noticed my network > behaving strangely especially through wireless connections. [...] I can't give you any input on your specific problem. But here is a pointer from the Securing Debian Manual (

Re: Have I been hacked?

Le 06.01.2015 19:04, Danny a écrit : However, I have a few other weird looking files in the /boot directory. Can you guys please have a look at them and tell me if they are normal or not. # drwxr-xr-x 3 root root 4.0K Jan 6 19:35 . drw

Re: Have I been hacked?

Am Dienstag, 6. Januar 2015, 20:04:56 schrieb Danny: > Hi guys, Hi Danny! > A while ago I posted a question about SFTP (I think the thread name was > "SFTP Question") about attacks I got against my server after syslog warned > me about an attempted breakin. > > Consequently I installed fail2ban

Have I been hacked?

Hi guys, A while ago I posted a question about SFTP (I think the thread name was "SFTP Question") about attacks I got against my server after syslog warned me about an attempted breakin. Consequently I installed fail2ban and did a few other things to let me sleep better at night. However, prior

Re: Have I been hacked?

On Mon, Jan 01, 2001 at 12:46:55 -0600, Kenneth Stephen wrote: > Looking at the system logs for my Potato system (it was Slink, but I > apt-get upgraded), I see some unusual entries. From messages.0 : > > Dec 31 05:29:18 marvin 173>Dec 31 05:29:18 /sbin/rpc.statd[300]: > gethostbyname error f

Have I been hacked?

Hi, Looking at the system logs for my Potato system (it was Slink, but I apt-get upgraded), I see some unusual entries. From messages.0 : Dec 31 05:29:18 marvin 173>Dec 31 05:29:18 /sbin/rpc.statd[300]: gethostbyname error for ^X÷ÿ¿^X÷ÿ¿^Y÷ÿ¿^Y÷ÿ¿^Z÷ÿ¿^Z÷ÿ¿^[÷ÿ¿^[÷ÿ¿b6ec 804a174400f00786

<    1   2