bad thing Re: Compromised-machine?? netbus-

[Alvin Oga <aoga@ns.Linux-Consulting.com>]

hi ya tripolar

On Thu, 27 May 2004, tripolar wrote:

> What logs?

/var/log/{messages,syslog,debug,warn}
 
> here are a few lines from "hit" list
> time:May 27 21:22:29 in: out:eth1 port:12345 source:192.168.1.1 
> dest:81.53.*.* len:44 tos:0x00 protocol:tcp service:netbus
> time:May 27 22:10:38 in: out:eth1 port:1234 source:192.168.1.1 
> dest:63.207.*.* len:40 tos:0x00 protocol:tcp service:subseven

it says subseven is running on your 192.168.1.1 box ... or something
that uses that default service name
 
if 192.168.1.1 is a windoze box ... it's been hacked/trojaned

if 192.168.1.1 is a deb box... why is subseven or equivalent running on it
	- how did it get there

	- how do you update your deb boxes ...
	( if it is a deb box... time to rebuild or find somebody
	( locally to figure out what is broken on your box

"google: subseven" and the first 2 links is what you need/want ...

> >what is the output of "netstat -nv"
> >  
> >
> netstat -nv only brought up two addresses- my isps mail servers

you have to have the cracker online at the time for netstat to show
who's using the machine ... and/or a lazy script kiddie will stay
on 24x7 ( and get caught )

you have to run netstat say every minute ... 
	- exclude your own ip# and allowed ports and see who is 
	left that using yuor box

c ya
alvin