Someone's done an interesting analysis of a Linux box that got compromised and used as a zombie box. If you're into Linux it's worth a read to see how a box can get owned and what to look out for.

i didnt really understand all of the commands used etc, but he explains very clearly what was going on. that was a really good read

Woha! The box had been cracked alright! I found this quite exciting, but obviously, my friend did not.

heh

that was interesting

Interesting but just seems what every other trojan/backdoor problem regardless of OS would do. Install itself, add hacked system files, etc. I'm wondering how it got comprimised in the first place though, that'd be the most interesting information.

Was it a simple root password, stupid sysadmin giving out free shell accounts or so on..

Sendmail (prior to Sendmail 8.6.10) was no doubt the cause of this hack.

i use to keep a little tar ball of ls, ps, top, netstat and ifconfig to investigate this kind of thing.

a md5 on those binaries would show up inconsistancies since most root kits replace them instead of modifying the kernel as it is a quicker and easier path.

my money is it was from php-nuke or some such dodgey CMS.

gimpy's probably right, only newbs run Sendmail.

that's what ya mum said, right after i made love to her

our faces were like this :O :O

Interesting read

I have experienced a top leveling hacking group at work from the wrong side. Starting around 7pm on a Friday, all finished by Monday. They got in via a new BIND vulnerability, using a hacked webserver at the Argentinian version of Telstra. Then procedign to go after security and military server in Canada and the US.

First I knew of it was a phone call from the AFP on the Thursday after it, in conference with the DNDCF (or some acronym like that ie. Canadian Military), Pentagon and FBI. Long story hours on the phone.

Then a day latter some guys from Cert AU rang and helped me to clean it up and they got the info they needed to work out how they cracked BIND.

*shrug*

Christ, this is probably one of the best non-gaming related news ports on QGL. Thanks for posting this! VERY INTERESTING!

Interesting read

Interesting skim. Not really what I would call interesting as a read :)

tah, I was wondering whether or not raven would call it an interesting read