Re: a compromised machine

To: debian-security@lists.debian.org
Subject: Re: a compromised machine
From: Davide Prina <davide.prina@gmail.com>
Date: Wed, 27 Jul 2005 08:13:15 +0200
Message-id: <[🔎] 42E725FB.80909@gmail.com>
In-reply-to: <[🔎] 42E6BAE7.4020900@soncek.biz>
References: <[🔎] D0B6C1BAE46CD711B8E70048545A2AC90C9222@serveur2.tg.lan> <[🔎] 42E696EC.6050006@soncek.biz> <[🔎] 20050726203919.GA9459@peaches-en-regalia> <[🔎] 20050726223219.GA1200@kufelek> <[🔎] 42E6BAE7.4020900@soncek.biz>

Nejc Novak ha scritto:

So, for now i killed this process, disabled the cronjob and killed webserver - there is now way the attacker is capable of coming back intoserver or is there a chance that there is another backdoor installedsomewhere (chkrootkit doesn't find anything).


try also rkhunter

http://www.rootkit.nl/

Probably this will be a Debian package soon (?)
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=243938

Ciao
Davide

--
Linux User: 302090: http://counter.li.org

Reply to:

References:
- RE: a compromised machine
  - From: Mathieu JANIN <Matt@tgcaen.dyndns.biz>
- Re: a compromised machine
  - From: Nejc Novak <nejc@soncek.biz>
- Re: a compromised machine
  - From: Edward Faulkner <ef@alum.mit.edu>
- Re: a compromised machine
  - From: Marcin Owsiany <porridge@debian.org>
- Re: a compromised machine
  - From: Nejc Novak <nejc@soncek.biz>

Prev by Date: Re: Please announce current lack of security support
Next by Date: Re: [SECURITY] [DSA 765-1] New heimdal packages fix arbitrary code execution
Previous by thread: Re: a compromised machine
Next by thread: RE: a compromised machine
Index(es):
- Date
- Thread