If you run a web server, read this

[Anne Wilson]

This appeared on the CentOS mailing list:

<quote>
Linked below are details about a new outbreak of hijacked linux web
servers that dispense malware.

http://blog.unmaskparasites.com/2009/09/11/dynamic-dns-and-botnet-of-zombie-
web-servers/

I would highly recommend that you use nmap to scan all your Linux
webservers that are connected to the Internet to see if they are
listening on port 8080.

The best I can tell, there are no articles concerning how these guys
installed nginx or what is contained on a machine that has been
compromised.  But the best way to tell is to see if you are listening on
port 8080 (if you are not supposed to be listening there).  8080 is a
common port for java apps to be running on, so listening on 8080 is not
always necessarily bad.

Thanks,
Johnny Hughes
</quote>

Anne
-- 
New to KDE4? - get help from http://userbase.kde.org
Just found a cool new feature?  Add it to UserBase
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part.
Url : http://lists.fedoraproject.org/pipermail/users/attachments/20090914/c0d10e73/attachment-0001.bin