Re: Ma Debian victime de l'exploit dd_ssh ... Oh my god !

To: debian-user-french@lists.debian.org
Subject: Re: Ma Debian victime de l'exploit dd_ssh ... Oh my god !
From: "lann@worldonline.fr" <lann@worldonline.fr>
Date: Sun, 15 Aug 2010 20:16:29 +0200
Message-id: <[🔎] 1281896189.2844.5.camel@lamourec-desktop>
In-reply-to: <[🔎] 201008151600.24865.salokine.terata@free.fr>
References: <[🔎] 201008151600.24865.salokine.terata@free.fr>

Bonjour

Je comprends mieux pourquoi j'ai eu ça dans mon error.log

Fri Aug 13 21:14:00 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2
[Fri Aug 13 21:14:00 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/php-my-admin
[Fri Aug 13 21:14:00 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.2.3
[Fri Aug 13 21:14:00 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.2.6
[Fri Aug 13 21:14:00 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.5.1
[Fri Aug 13 21:14:00 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.5.4
[Fri Aug 13 21:14:00 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.5.5-rc1
[Fri Aug 13 21:14:00 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.5.5-rc2
[Fri Aug 13 21:14:01 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.5.5
[Fri Aug 13 21:14:01 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.5.5-pl1
[Fri Aug 13 21:14:01 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.5.6-rc1
[Fri Aug 13 21:14:01 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.5.6-rc2
[Fri Aug 13 21:14:01 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.5.6
[Fri Aug 13 21:14:01 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.5.7
[Fri Aug 13 21:14:01 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.5.7-pl1
[Fri Aug 13 21:14:01 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.0-alpha
[Fri Aug 13 21:14:02 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.0-alpha2
[Fri Aug 13 21:14:02 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.0-beta1
[Fri Aug 13 21:14:02 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.0-beta2
[Fri Aug 13 21:14:02 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.0-rc1
[Fri Aug 13 21:14:02 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.0-rc2
[Fri Aug 13 21:14:02 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.0-rc3
[Fri Aug 13 21:14:02 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.0
[Fri Aug 13 21:14:03 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.0-pl1
[Fri Aug 13 21:14:03 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.0-pl2
[Fri Aug 13 21:14:03 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.0-pl3
[Fri Aug 13 21:14:03 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.1-rc1
[Fri Aug 13 21:14:03 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.1-rc2
[Fri Aug 13 21:14:03 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.1
[Fri Aug 13 21:14:03 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.1-pl1
[Fri Aug 13 21:14:03 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.1-pl2
[Fri Aug 13 21:14:04 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.1-pl3
[Fri Aug 13 21:14:04 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.2-rc1
[Fri Aug 13 21:14:04 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.2-beta1
[Fri Aug 13 21:14:04 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.2-rc1
[Fri Aug 13 21:14:04 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.2
[Fri Aug 13 21:14:04 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.2-rc1
[Fri Aug 13 21:14:04 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.2
[Fri Aug 13 21:14:04 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.2-pl1
[Fri Aug 13 21:14:04 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.3
[Fri Aug 13 21:14:04 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.3-rc1
[Fri Aug 13 21:14:05 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.3
[Fri Aug 13 21:14:05 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.3-pl1
[Fri Aug 13 21:14:05 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.4-rc1
[Fri Aug 13 21:14:05 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.4-pl1
[Fri Aug 13 21:14:05 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.4-pl2
[Fri Aug 13 21:14:05 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.4-pl3
[Fri Aug 13 21:14:05 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.4-pl4
[Fri Aug 13 21:14:06 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.6.4
[Fri Aug 13 21:14:06 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.7.0-beta1
[Fri Aug 13 21:14:06 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.7.0-rc1
[Fri Aug 13 21:14:06 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.7.0-pl1
[Fri Aug 13 21:14:06 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.7.0-pl2
[Fri Aug 13 21:14:06 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.7.0
[Fri Aug 13 21:14:06 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.8.0-beta1
[Fri Aug 13 21:14:06 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.8.0-rc1
[Fri Aug 13 21:14:07 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.8.0-rc2
[Fri Aug 13 21:14:07 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.8.0
[Fri Aug 13 21:14:07 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.8.0.1
[Fri Aug 13 21:14:10 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.8.0.3
[Fri Aug 13 21:14:10 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.8.0.4
[Fri Aug 13 21:14:10 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.8.1-rc1
[Fri Aug 13 21:14:10 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.8.1
[Fri Aug 13 21:14:10 2010] [error] [client 83.170.113.47] File does not
exist: /var/www/phpMyAdmin-2.8.2


Le dimanche 15 août 2010 à 16:00 +0200, Salokine Terata a écrit : 
> Bonjour,
> 
> Mardi, mon serveur a été victime de l'exploit dd_ssh/vm.c
> 
> http://news.softpedia.com/news/Compromised-Web-Servers-Used-to-Build-SSH-Brute-Force-Botnet-151779.shtml
> 
> Mon fournisseur m'a vérrouillé mon serveur. J'ai une copie en lecture seule si nécessaire (accès FTP).
> 
> Ce serveur était update-to-date Debian (pas d'autre dépôt). A priori, la faille provient de phpMyAdmin, une version ancienne (mais qui doit être celle 
> de ma Debian 5.0.4). Je suis entrain de rechercher d'autres preuves d'intrusion...
> 
> Question:
> Perso, mon système est compromis, je serais dans l'obligation de le réainstaller plustard et ça ne me pose aucune soucis (sauvegarde distante ok)
> Pour Debian: Existe-il un groupe intéressé par ce genre d'attaque ? Si nécesssaire je peux mettre mon système (une copie) à dispo sur le net pour diag
> 
> En espérant que ça puisse aider à d'autre.
> Bonne journée.
> Salokine
>

Reply to:

References:
- Ma Debian victime de l'exploit dd_ssh ... Oh my god !
  - From: Salokine Terata <salokine.terata@free.fr>

Prev by Date: Re: Xchat: problème avec DCC - WAS: 3G Orange vs SFR
Next by Date: Re: Xchat: problème avec DCC - WAS: 3G Orange vs SFR
Previous by thread: Re: Ma Debian victime de l'exploit dd_ssh ... Oh my god !
Next by thread: Re: Ma Debian victime de l'exploit dd_ssh ... Oh my god !
Index(es):
- Date
- Thread