Been Hacked

[sarm]

I've been hacked

Here's what they did

ftp
tar -x2vf bnc2.4.4.tar.gz
cd bnc2.4.4
./configure
make
ls
./bcn
irc
BitchX

Is there anyway to recover besides reloading. Obviously whomever simply was able to gain acces via ftp. What needs to be done to tighten ftp access?

Thanks

 

[sarm]

Found out this is what's known as a bouncer program at the following url. BNC

http://www.user-com.undernet.org/newsletter/archives/2000/newsletter03-00.html#bouncers

Does this mean that someone is stealing internet access using my connection?
How to prevent from happening again??

 

[ifincham]

Hi,





I think this is just a way to hide your real origin IP when using IRC - a kind of proxy if you like. Its even mentioned in the IRC howto -->

http://www.ibiblio.org/pub/Linux/docs/HOWTO/mini/other-formats/html_single/IRC.html#BOUNCERS

However, even if it is so innocuous and only masquerading as your box, there must be a risk that something else will be done of a more serious nature. So, yes you'd have to tighten up on the ftp side and any other servers you have exposed to the internet. Presumably you are running an iptables/ipchains firewall ? Also, there have certainly been a few problems with wu-ftpd (e.g.

http://www.redhat.com/support/errata/RHSA-2001-157.html)

so I'd grab the latest rpms and maybe consider changing to something like vsftpd or proftpd.





Hope this helps

 

[sarm]

Hi ifincham,

Yes, I will probably grab the latest rpms even though there's contraversy over wu-ftpd 2.6.2 already. I should have ftp disabled when not in use as well for extra security huh. I understand the ftp version that shipped with rh7.1 is vulnerable to the bnc. The program via ftp packet storms your server until it gains root access by buffer overflow and then does as you mention in your reply about aliasing your ip for irc.
I guess it's a good thing in a way that this happened. Now I can go off and patch another security hole. The intruder may not be so fortunate the next time.

Take care..

 

[johnhoke]

First of all, there is no way for you to know that is *ALL* they did. If they were able to root your box, they can clean log files, and otherwise hide their tracks...
I would reinstall and then reload the data from tape (you do backup your box right<G>)

---
John Hoke<br>