Date: Tue, 10 Dec 1996 08:43:31 -0600 (CST) From: igor vladimirovich roshchin <igor@students.uiuc.edu> To: tabo@io.org Cc: freebsd-security@FreeBSD.ORG Subject: Re: URGENT: Packet sniffer found on my system Message-ID: <199612101443.IAA01109@ux9.cso.uiuc.edu>
next in thread | raw e-mail | index | archive | help
Hi, powerfull All! I don't know how relevant this is, but it might give you some clue. On my FreeBSD box I've recently seen that somebody (different people, from different hosts (from different countries)) attacked, using smth. similar, if not exactly "attack of service denial" This happened both with "standard" ftpd and wu-ftpd. Attacker was just opening multiple connections until the limit of opened files was reached. THen, I am not sure what happened, I hope he was not able to get anything from that, but not completely sure. Since syslogd doesn't log ftpd messages separately, I'd advise you to use !ftpd *.* /var/log/ftp.log or something similar. This might help you to be sure you are not getting the abuser through ftp. You can also set logging of all the commands been issued , using /usr/local/etc/ftpaccess. Try also log your activity to another host as well (to prevent erasing logfiles by the attacker): e.g.: *.notice;auth.* @very.secured.host (I am talking about /etc/syslog.conf) BTW, you are using find to find these or those files (and ls), check those binaries, they could've been "patched". Have you also checked binaries which are run from crontab, like /sbin/adjkerntz^I-a and /usr/libexec/atrun making sure they are not "patched" ? Check also libc.a and ld.so, making sure they are not rewritten. BTW, Although this is not crucial, but you seem to be using sendmail from the original package, probably without FreeBSD patches. (With FreeBSD patches you would not get some of the hardlinks to sendmail; the would be just 3 files) I think you don't really need the "hoststat" program, do you ? You are using screen. I haven't been following the evolution of this package (just haven't heard about it recently), but remember that there were some security issues regarding it. May be somebody can confirm or reject this possibility. Sorry if I wrote something too obvious or lame, but I just tried to think about other possibilities.... Igor
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199612101443.IAA01109>