Re: bad thing Re: Compromised-machine?? netbus-
Alvin Oga wrote:
here is part of /var/log/syslog- there are 7 requests from my machine
over several minutes
hi ya tripolar
On Thu, 27 May 2004, tripolar wrote:
here are a few lines from "hit" list
time:May 27 21:22:29 in: out:eth1 port:12345 source:192.168.1.1
dest:81.53.*.* len:44 tos:0x00 protocol:tcp service:netbus
time:May 27 22:10:38 in: out:eth1 port:1234 source:192.168.1.1
dest:63.207.*.* len:40 tos:0x00 protocol:tcp service:subseven
it says subseven is running on your 192.168.1.1 box ... or something
that uses that default service name
if 192.168.1.1 is a windoze box ... it's been hacked/trojaned
if 192.168.1.1 is a deb box... why is subseven or equivalent running on it
- how did it get there
- how do you update your deb boxes ...
( if it is a deb box... time to rebuild or find somebody
( locally to figure out what is broken on your box
"google: subseven" and the first 2 links is what you need/want ...
what is the output of "netstat -nv"
netstat -nv only brought up two addresses- my isps mail servers
you have to have the cracker online at the time for netstat to show
who's using the machine ... and/or a lazy script kiddie will stay
on 24x7 ( and get caught )
you have to run netstat say every minute ...
- exclude your own ip# and allowed ports and see who is
left that using yuor box
May 28 00:34:32 fatboy kernel: IN= OUT=eth1 SRC=192.168.1.1
DST=81.53.*.* LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=49686 DF PROTO=TCP
SPT=48961 DPT=12345 WINDOW=5808 RES=0x00 SYN URGP=0
May 28 00:45:04 fatboy -- MARK --
May 28 00:47:52 fatboy kernel: IN= OUT=eth1 SRC=192.168.1.1
DST=81.168.*.* LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=15482 DF PROTO=TCP
SPT=23190 DPT=1234 WINDOW=0 RES=0x00 ACK RST URGP=0
This is a Debian-Sid machine. My guess is Operator errors :-( Probably
too many to list. Hmmm checking out two websites about subseven and I
only see windoze versions- hmmm maybe I have been using too much "WINE"
and got myself into trouble?? Oh well, I installed this with 2.6 kernel
and have debated whether or not I should have started with 2.4 kernel.
Might be as good a time as any to reinstall :-)