Re: brute force ssh attack

[Daniel Kirsten]

> You do have all of the latest patches installed and are running the current
> kernel, right? Some investigation of the files the users installed and the
> commands they ran if we're lucky (some of these people forget to clear
> .bash_history) would be very helpful, 'cause it sounds like we've got an
> unpatched exploit....

I use Fedora Core 3, and I installed all the updated rpm's. 
I use a kernel 2.6.12-rc3-RT-V0.7.46-02  (Ingo Molnar's patch)

brute force ssh attack

[Matthew Miller]

On Wed, Apr 27, 2005 at 03:02:41PM +0200, Daniel Kirsten wrote:
> I use Fedora Core 3, and I installed all the updated rpm's. 
> I use a kernel 2.6.12-rc3-RT-V0.7.46-02  (Ingo Molnar's patch)

Were there any interesting files in the users' home directories? (Look for
hidden files too, of course -- maybe a hidden directory named ... or
something.) Also check in /tmp and /var. And any luck with the
.bash_history? (For both the users and for root....)

brute force ssh attack

[Håkan Persson]

Matthew Miller wrote:
> Were there any interesting files in the users' home directories? (Look for
> hidden files too, of course -- maybe a hidden directory named ... or
> something.) Also check in /tmp and /var. And any luck with the
> .bash_history? (For both the users and for root....)

I have installed and use this stuff, http://www.rootkit.nl/, but it has
never found any vulnerabilities (which probably does mean anything...)

/Håkan

brute force ssh attack

[Matthew Miller]

On Wed, Apr 27, 2005 at 03:20:08PM +0200, Håkan Persson wrote:
> > Were there any interesting files in the users' home directories? (Look for
> > hidden files too, of course -- maybe a hidden directory named ... or
> > something.) Also check in /tmp and /var. And any luck with the
> > .bash_history? (For both the users and for root....)
>
> I have installed and use this stuff, http://www.rootkit.nl/, but it has
> never found any vulnerabilities (which probably does mean anything...)

Clearly the people who broke into this system found something. I'm
interested to learn _what_.

brute force ssh attack

[thomas cameron]

----- Original Message ----- 
From: "Matthew Miller" 
To: "For users of Fedora Core releases" 
Sent: Wednesday, April 27, 2005 8:07 AM
Subject: Re: brute force ssh attack
> On Wed, Apr 27, 2005 at 03:02:41PM +0200, Daniel Kirsten wrote:
> > I use Fedora Core 3, and I installed all the updated rpm's.
> > I use a kernel 2.6.12-rc3-RT-V0.7.46-02  (Ingo Molnar's patch)
>
> Were there any interesting files in the users' home directories? (Look for
> hidden files too, of course -- maybe a hidden directory named ... or
> something.) Also check in /tmp and /var. And any luck with the
> .bash_history? (For both the users and for root....)

Especially /var/tmp - that's a common place for rootkits to live.

brute force ssh attack

[M.Rudra]

On 4/27/05, Thomas Cameron  wrote:
> > something.) Also check in /tmp and /var. And any luck with the
> > .bash_history? (For both the users and for root....)
>
> Especially /var/tmp - that's a common place for rootkits to live.

a doubt  here ,

i checked /tmp and found

srwxrwxrwx    1 wnn      wnn             0 Apr 27 22:30 jd_sockV4 
why does this file (socket) have different owner and user, while all
others have either root or  userabc.

drwxrwxrwt    2 xfs      xfs          4096 Apr 29 22:30 .font-unix
this hidden file also has different permission and different owner and
user, while others have either root or  userabc.

xfs and wnn ? are not users created by me so where did they come from ?

Can someone please clear this silly doubt.

brute force ssh attack

[ne...]

On 4/29/05, M.Rudra  wrote:
> On 4/27/05, Thomas Cameron  wrote:
> > > something.) Also check in /tmp and /var. And any luck with the
> > > .bash_history? (For both the users and for root....)
> >
> > Especially /var/tmp - that's a common place for rootkits to live.
>
> a doubt  here ,
>
> i checked /tmp and found
>
> srwxrwxrwx    1 wnn      wnn             0 Apr 27 22:30 jd_sockV4
> why does this file (socket) have different owner and user, while all
> others have either root or  userabc.
>
> drwxrwxrwt    2 xfs      xfs          4096 Apr 29 22:30 .font-unix
> this hidden file also has different permission and different owner and
> user, while others have either root or  userabc.
>
> xfs and wnn ? are not users created by me so where did they come from ?

xfs is the font server, do not know whay wnn is. Check /etc/passwd
for the list of users for the system.

N.Emile...

wnn user (was Re: brute force ssh attack)

[Joel]

On Fri, 29 Apr 2005 17:27:58 -0400
"M.Rudra"  wrote
> On 4/27/05, Thomas Cameron  wrote:
> > > something.) Also check in /tmp and /var. And any luck with the
> > > .bash_history? (For both the users and for root....)
> >
> > Especially /var/tmp - that's a common place for rootkits to live.
>
> a doubt  here ,
>
> i checked /tmp and found
>
> srwxrwxrwx    1 wnn      wnn             0 Apr 27 22:30 jd_sockV4 
> why does this file (socket) have different owner and user, while all
> others have either root or  userabc.

wnn is your input method's user. (That's the software that allows you to
type in non-Latin script with more characters than fit on the keyboard.)
> [...]

--
Joel Rees   
digitcom, inc.   株式会社デジコム
Kobe, Japan   [phone]
** http://www.ddcom.co.jp **