Beware, i was hacked

ArmoArmo Mr. Nice Guy Is Dead,Only Aqua Remains Member
edited February 2006 in Science & Tech
my machine was hijacked by 1 if not 2 people ranging from

83.67.86.196
83.196.74.94

both of which originate from Amsterdam

they installed a remote administration tool as well as ServUFTP and ServUDaemon. on 2/2/2006 @ approx 2:48AM east.

they hijacked my RealVNC service when i was using my machine one day. as i saw my cursor move on its own to browse one of my drives properties. I have since done a system restore to remove all inlaid DLL callers and EXE's from the registries, as well as the services that run on the machine. I also locked down my machine.

is there any sort of action i can take against these people knowing the DNS servers they used as IP addresses, i also have audit logs of when they connected. also can a linksys router block subnets?

Comments

  • TroganTrogan London, UK
    edited February 2006
    Armo, I'm working on a thread here. A similar thing is happening to the user in the thread as what your saying...

    EDIT: If the problem persists, i'l tell the user to do a system restore like you did.
  • ArmoArmo Mr. Nice Guy Is Dead,Only Aqua Remains Member
    edited February 2006
    OK, ill read throuhg it and hopefully have some input.

    I also found out what they did with the FTP, from 2AM till about 9 PM, when i got home from work, they had uploaded 14 gigs of french movies. see now had they been good movies in english i would have let them keep going, lol
  • sfleurietsfleuriet Texas New
    edited February 2006
    Man that really sucks... ServUFTP and ServUDaemon are very good programs that I have used myself.
  • ArmoArmo Mr. Nice Guy Is Dead,Only Aqua Remains Member
    edited February 2006
    lol, i bet they freaked out when they saw how much space i have, lol. i still cant belive they sent me 14 gigs in about 15 hours. just everyone be careful adn dont become a crc%20zombie.jpg
  • hypermoodhypermood Smyrna, GA New
    edited February 2006
    Out of curiosity, did they brute force your password?
  • ArmoArmo Mr. Nice Guy Is Dead,Only Aqua Remains Member
    edited February 2006
    well realvnc runs as a service that awaits inbound connections. also that same machine is in the dmz so theres no real telling how they did irt. i mean u can do a port scan and see the waiting connection in vnc. so now i have the security beefed up on it with a hugly improved password and i made a conection list of valid ips i allow to connect to it. i may just take the server down when i get home
  • BudBud Chesterfield, Va
    edited February 2006
    that sounds like something that would happen to you armo go with remotlyanywhere its soo nice. I switch my ports every other week to, oh yea all high level too. How much free space do you have?
  • ArmoArmo Mr. Nice Guy Is Dead,Only Aqua Remains Member
    edited February 2006
    mm on my D: about 160 gigs. on my array its about 325gigs
  • BudBud Chesterfield, Va
    edited February 2006
    how many arrays do u have?
  • ArmoArmo Mr. Nice Guy Is Dead,Only Aqua Remains Member
    edited February 2006
    just one array and one volume on it at 1.09TB
  • BudBud Chesterfield, Va
    edited February 2006
    ah i see
  • drasnordrasnor Starship Operator Hawthorne, CA Icrontian
    edited February 2006
    A machine in Poland tried to brute force the SSH server on SM25 and failed thankfully. I added his IP to SM25's block list and forwarded the log file to his ISP. Hopefully they'll do something but I'm not holding my breath.

    Funny thing, they never got to guess any passwords because they couldn't guess the login name. I find it odd that they tried every variation of "admin" under the sun and varieties of common names but never tried the most obvious one: root.

    -drasnor :fold:
  • ArmoArmo Mr. Nice Guy Is Dead,Only Aqua Remains Member
    edited February 2006
    root huh.. hmmm DNS lookup drasnor...
  • GrayFoxGrayFox /dev/urandom Member
    edited February 2006
    drasnor wrote:
    A machine in Poland tried to brute force the SSH server on SM25 and failed thankfully. I added his IP to SM25's block list and forwarded the log file to his ISP. Hopefully they'll do something but I'm not holding my breath.

    Funny thing, they never got to guess any passwords because they couldn't guess the login name. I find it odd that they tried every variation of "admin" under the sun and varieties of common names but never tried the most obvious one: root.

    -drasnor :fold:
    A more effective solution would be to change the ssh port 
    /etc/ssh/sshd_config
    is the location of the config

    Its a very bad idea to leave ssh on the default port unless you have ssh login as root disabled and your box is urber secure.


    Edit:Also the best way to ban anyone is to do a reverse dns on anyone who connects to your server then ban anyone using the targets dns server.
  • drasnordrasnor Starship Operator Hawthorne, CA Icrontian
    edited February 2006
    Not a bad idea. Of course, now it's uber-secure; offline, in a box, waiting for shipment.

    -drasnor :fold:
Sign In or Register to comment.