Re: exploit or human

[Jose Maria Lopez Hernandez <jkerouac () bgsec com>]

El jue, 31-03-2005 a las 17:59 -0300, Eduardo Kienetz escribió:
> On Thu, 31 Mar 2005 18:14:49 +0200, Victor Calzado <vcalzado () gmail com> wrote:
> > Hi,
> >
> > Valentin Avram wrote:
> >
> > > Hello.
> > >
> > > Most of the symptoms you describe and the "sudden" falling of more
> > > systems does point to a rootkit that was installed on the first
> > > compromised machine (FC2). That machine might have been later used to
> > > gain access to the other servers in your network.
> > ...
> > > Also the failure to restart the server
> > > usually is a consequence of that. One way to make that sure is to get
> > > the hdd from the possibly compromised machine, put it on an offline
> > > system which has rkhunter (or other rootkit-detection software)
> > > installed and check it. After the signs you described, it quite very
> > > probably you'll find a rootkit.
> > >
> > > RH's before RHEL are ok (from the stability point of view) as long as
> > > you keep the exposed services uptodate (recompilation from source).
> > > Don't use the old software they come with, cause you might just open a
> > > door to your system.
> > ...
> > I'm sorry but probably you will find more infected systems all over your
> > network. You will probably need to reinstall every compromised server
> > and any content recovered from an "infected" system should be scanned
> > for viri and checked for rootkits.
>
> Run chkrootkit: http://www.chkrootkit.org
>
> Regards,

Or try rkhunter: http://www.rootkit.nl/
It's a more advanced program to detect rootkits
than chkrootkit, and can be updated online.

Regards.

-- 

Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac () bgsec com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
                -- Jack Kerouac, "On the Road"