In 2001 I was running a redhat 6.1 server at my house, and the ftp had a known vulnerability in it, but I didn't use ftp so I ignored the update. Then someone was over at my place and trying to retrieve an ancient mail archive from an old account, and asked me to turn it on briefly so they could upload it to me; in the couple of hours it was on, a worm installed a rootkit and a IRC based control thing. None of it worked because it was compiled against different versions of libraries; it hung with a full cpu load, which is how I discovered it. I was using TripWire at the time so I was able to identify all the files that changed. I tracked the attack back to someone else's Redhat 6.1 running on a residential DSL line in S. California, which had a web page advertising an auto salvage place on it, and I got no responses to my friendly emails. I started paying attention to my TripWire reports after that. I cleaned up by deleting individual files ( I saved and examined them with various tools.)
I had a customer in the VoIP / Calling Card area who was using a server provided as surplus by someone who feed him overseas calls, and he kept losing his overseas termination contracts and he suspected this dude had put a backdoor on the server and was finding them and cutting out the middle man, and he was right, a disguised sshd listening on a weird port. The customer decided to leave the backdoor open and pass only selected traffic through that box.
A different customer was traveling and from a university computer cluster ssh'd back into the server I built for him from a machine that had a trojaned sshd. The guy came in and trojaned / rootkitted that box, and followed my cron job of a key-based ssh login that scp'd the backups off that nightly back to one of my personal machines, and somehow upgraded priviledges to root. I discovered it because I happened to be looking at top when he started compiling some hacker tools on my box. He left bundles of php code in various directories hidden by having a name of three spaces and etc, the code was web scrapers of email addresses and phishing pages that looked like the login to various bank sites.
By this time I using integrit instead of tripwire, and on debian. I disconnected all the infected / suspected servers, booted them from various livecds, and scanned them for rootkits; then I wrote a few lines of perl that re-installed every installed debian package, overwiring files, and listed every file on the system that was not from a debian package. That was how I found the directories with 3 spaces for a name and etc.
That guy kept coming back for 6 months or so -- every couple of weeks, there would be a single login attempt on some server I owned, using the distinctive username that was part of the cronjob backup. I would track down the ISP or administrator of the IP he came from and report that the box was probably hacked, I was mostly ignored but I did get a few notes of thanks and I did have a conversation with some college kid running his frat's web site on how to keep his linux secure.
Several times I have helped people who used one of the cheaper web hosting places clean out little snippets of php code out of all their files, that were probably put there for SEO / scamming purposes by an employee of the hosting company or a customer of them that had figured out how to escalate privileges. I think that is actually pretty common, but most people never notice because they only upload files, to their site, they never download and their integrity months later.
There are probably a few that I have forgotten too. I have a usb thumb drive I keep a collection of rootkits, phishing code, etc gleaned from break-ins of my computers or obtained from friends.
I had two or three compromises of client machines that all fell into the catagory of a Redhat 9 box with the original, un-updated, vulnerable samba running; the machines were never intended to be connected to the internet, but were connected briefly to dialup allow remote support. In those cases we wiped the boxes clean.
In 2001 I was running a redhat 6.1 server at my house, and the ftp had a known vulnerability in it, but I didn't use ftp so I ignored the update. Then someone was over at my place and trying to retrieve an ancient mail archive from an old account, and asked me to turn it on briefly so they could upload it to me; in the couple of hours it was on, a worm installed a rootkit and a IRC based control thing. None of it worked because it was compiled against different versions of libraries; it hung with a full cpu load, which is how I discovered it. I was using TripWire at the time so I was able to identify all the files that changed. I tracked the attack back to someone else's Redhat 6.1 running on a residential DSL line in S. California, which had a web page advertising an auto salvage place on it, and I got no responses to my friendly emails. I started paying attention to my TripWire reports after that. I cleaned up by deleting individual files ( I saved and examined them with various tools.)
I had a customer in the VoIP / Calling Card area who was using a server provided as surplus by someone who feed him overseas calls, and he kept losing his overseas termination contracts and he suspected this dude had put a backdoor on the server and was finding them and cutting out the middle man, and he was right, a disguised sshd listening on a weird port. The customer decided to leave the backdoor open and pass only selected traffic through that box.
A different customer was traveling and from a university computer cluster ssh'd back into the server I built for him from a machine that had a trojaned sshd. The guy came in and trojaned / rootkitted that box, and followed my cron job of a key-based ssh login that scp'd the backups off that nightly back to one of my personal machines, and somehow upgraded priviledges to root. I discovered it because I happened to be looking at top when he started compiling some hacker tools on my box. He left bundles of php code in various directories hidden by having a name of three spaces and etc, the code was web scrapers of email addresses and phishing pages that looked like the login to various bank sites.
By this time I using integrit instead of tripwire, and on debian. I disconnected all the infected / suspected servers, booted them from various livecds, and scanned them for rootkits; then I wrote a few lines of perl that re-installed every installed debian package, overwiring files, and listed every file on the system that was not from a debian package. That was how I found the directories with 3 spaces for a name and etc.
That guy kept coming back for 6 months or so -- every couple of weeks, there would be a single login attempt on some server I owned, using the distinctive username that was part of the cronjob backup. I would track down the ISP or administrator of the IP he came from and report that the box was probably hacked, I was mostly ignored but I did get a few notes of thanks and I did have a conversation with some college kid running his frat's web site on how to keep his linux secure.
Several times I have helped people who used one of the cheaper web hosting places clean out little snippets of php code out of all their files, that were probably put there for SEO / scamming purposes by an employee of the hosting company or a customer of them that had figured out how to escalate privileges. I think that is actually pretty common, but most people never notice because they only upload files, to their site, they never download and their integrity months later.
There are probably a few that I have forgotten too. I have a usb thumb drive I keep a collection of rootkits, phishing code, etc gleaned from break-ins of my computers or obtained from friends.
I had two or three compromises of client machines that all fell into the catagory of a Redhat 9 box with the original, un-updated, vulnerable samba running; the machines were never intended to be connected to the internet, but were connected briefly to dialup allow remote support. In those cases we wiped the boxes clean.