Sigh. I've been experiencing some weird things going on on my server and over the past few days have been investigating what is going on. It started when I noticed SSL errors in my error log complaining about wrong connection ids and OpenSSL errors. I eventually found:

http://www.auscert.org.au/render.html?it=2409

...which seemed to be related, so I upgraded OpenSSL to the latest version but the errors persisted.

Then I started noticing strange processes like:

./mech
./a /cgi-bin/moo.cgi

I noticed that updatedb was running but was excluding all the temp directories like /tmp and /var/tmp so I went into those directories and found a load of C files with compiled binaries. Ironically there were readme's with all the files which (luckily) told me exactly what the files were doing....running an IRC bot.

So I deleted all the files and killed the processes. I then checked for hidden files and found a load more including a bash history in /var/tmp which looked like:


Big sigh.

So I deleted everything and changed my root password. I'm at a loss as to how they are getting in. All the hacker files are owned by apache/apache so as a quick, dirty solution I have changed the permissions on the tmp directories so apache can't read/write.

I don't know whether I should completely restore redhat or not.

http://www.lordofdesire.net/

Hmm I wonder if this is the guy. I did find files with SmeNaRuL all over them and that is his IRC nic.

Guess I'll be emailing him.

Sad thing is, he looks quite a bit like me

Once your machine has been compromised, I'd do a clean install of the OS. Changing your root password and such won't help. If there's a backdoor on the system, then you really need to do a clean install. It's the only fool proof way of locking the guy out.

- wil

I think this is where I start crying.

http://securityresponse.symantec.com/...ux.slapper.worm.html

If you checkout the ".B" variant it mentions a file called .cinik ......

[root@paul /root]# locate .cinik

Every single directory in /home/httpd has a copy of the .cinik binary in it

Hi Paul

You might find that this helps:

http://www.cert.org/...stem_compromise.html

- wil

I love people like this:

Any recourse through his FREESERVERS.COM host for violation of TOS?

I emailed them two days ago but have had no reply.

Might be worth the cost to call them and express your concerns in person. You've got your log and that file is still resident on his server - would seem to be clear evidence on your behalf.

I got a reply.

http://www.lordofdesire.net/

Oops where'd it go