possibly hacked

[Robin Laing]

Amadeus W. M. wrote:
> On Thu, 16 Nov 2006 16:16:34 -0700, Robin Laing wrote:
> 
> 
>>Amadeus W. M. wrote:
>>
>>>On Thu, 16 Nov 2006 10:26:20 -0600, olga wrote:
>>>
>>>
>>>
>>>>Hi,
>>>>
>>>>I wrote about kernel errors which somebody pointed out was because the
>>>>server was running out of memory.
>>>>
>>>>Now I found the following which makes me think that that server may have
>>>>been compromized.
>>
>>snip
>>
>>
>>>If you can, unplug the network wire (though if they know what they are
>>>doing, your hard drive might be wiped off when their scripts detect that
>>>the network is down. It's your call.). Run rpm -V from a rescue cd (not the
>>>one in /usr/bin) on procps, net-tools, and the other essential system
>>>utilities (including rpm itself). Then you'll know for sure.
>>>
>>
>>Just posting a question in regards to this statement.
>>
>>How about pulling the plug and fscking the drive using the rescue CD? 
>>Not the best idea but could save a total wipe.
>>
> 
> 
> fsck checks the integrity of the file system (orphan inodes and such), not
> what's on it. 
> 
> I meant the hackers might have left some program behind to wipe off
> the drive to remove all their traces when the network goes down. 
> 
> The actions the victim will take are a different story, and might take
> depend on what's at stake. When I was hacked (a vulnerability in rpc.statd
> in RH6.2), there wasn't any sensitive data on the drive, so pulling the
> plug was not high risk. Script kiddies usually don't care to clean up
> after themselves, they leave behind a load of hacking tools. The former
> KGB agent, or the former FBI agent, on the other hand... If the victim is
> an important server, it might not even be possible (or easy) to take it
> off the network without some prior notice to the users. So it's the
> administrator's decision. It must be swift though, as a hacked machine is
> being used to scan and break into other machines. In fact that's how I new
> I was hacked, I started to receive emails from various universities that
> my machine was trying to break in into theirs.
> 

I was only thinking in the terms of a script to wipe out the drives/data 
being implemented on shutdown.  That is why I left the part about "your 
hard drive might be wiped off when their scripts detect that the network 
is down".  I wasn't thinking in terms of checking/verifying 
data/programs.  That was already discussed by booting into Rescue Mode. 
  I should have made myself clearer.

A hard crash is a good way to stop any running program.
-- 
Robin Laing