Linux Server hacked - how to trace back?

[localhost]

hi everyone,

i've got a little problem here...
by the last weekend, a linux server (SuSE 8.0 with selfcompiled apache/php/mysql, exim, bind)under my administration has been hacked (firewall has been disabled for some ip change reason, sadly...). after inspecting the system for changes i found out the intruder installed some irc software (namely mirkforce) and a rootkit ("init" executable changed) on my machine. logs showed, the intruder used an samba exploit to get into it.

luckily, i log the traffic passing my router, so i found out the main system penetration was initiated by a machine located in taiwan. but(!), by using some undeletion tools to recover the files the hacker used, i found out the guy has to be somewhere here in germany. he used a german irc server to connect to and german folder names for his tools. by portscanning the taiwanesian machine i found out, that the server there has to be a windows machine, offering web and email services. by open port 5000 (UPnP) i concluded, the hacker might have hijacked the computer by using the well known exploit and used it as an proxy server for his attack.

to track this a**hole, i decided not to close down my machine and reinstall, but to try getting more information to catch him. for this reason, i installed a kernel module to log all bash commands being input. further, i use tcpdump to log all connections.

so, finally, my question: has anyone suggestions for other tools being helpful to hunt this bastard down? something like a trap maybe?

thanks for reading so far,
greetings from germany!

127.0.0.1

--
^v^

127.0.0.1 - localhost

 

[happytom]

This gets a little touchy, if this guy/gal is good then they are going through mutiple boxes to get to you. If they are going through a proxy box then see if it is runing wingate or other telnet proxy software. You need to see what the log files from the hijacked box are to see the connected ip's that are comming into then out of that hijacked box. I would email the admin and tell them what is happening. I would put a IDS on the Linux box to record all that is happening and then present that data to the hijacked owner of that box. If the hacker is just useing that one box for defence then you will be able to get their email address. All the other things that I know would b illegal and I will not talk about them.

Let me know if I can help or send me some of the log files if you want.

Happy

Last night I lay in bed looking up at the stars in the sky and I thought to myself, where the hell is the ceiling?