help: I MAY be hacked

persia · Posted: Tue Oct 28, 2003 11:44 pm Post subject: help: I MAY be hacked

Hello

after installing this cool OS a couple of weeks ago, i justed exprienced my first crash (Actually it was a FREEZE)
Nothing responded anymore, not the mouse, keyboard nothing and all the sudden too! I was just browsing this forum and bang....
So i rebooted and restarted my speedtouch modem.

Now a couple of friends of mine think of hacking other students as student humor. So i suspect they may be involved in this one and maybe they are joking around. (They have done this often before when i did run NT and XP and one of the reasons for me to switch to Linux was security)

How can i verify this ? Please be clear on this, unlike my friends i am new to Linux.

Are there logs available? Can i check out what really happned with my computer ? Please someone help......

p.s. (i was just reading how to setup Iptables in the security section)

Thank you all guys
_________________
P4-2400mhz - 512MB Samsung(2700)
Asus P4PE - GForce TI 4200 POV 128MB -
Western Digital 80&120GB 7200rpm 8 MB Cache
Realtek NIC (BCM 4400) & Logitech MX500
BrookTree 878 Tv-Tuner Card

bmichaelsen · Posted: Wed Oct 29, 2003 12:00 am Post subject:

persia · Posted: Wed Oct 29, 2003 12:10 am Post subject: Aha

Hi bmichaelsen

ah yes i defenitly need to use that chkrootkit going to read the manuals tommorrow.
But i ve just checked the logs at /var/log and i must say: Man i did nt know it was that much! Is there a way to browse through it in a smart way??
_________________
P4-2400mhz - 512MB Samsung(2700)
Asus P4PE - GForce TI 4200 POV 128MB -
Western Digital 80&120GB 7200rpm 8 MB Cache
Realtek NIC (BCM 4400) & Logitech MX500
BrookTree 878 Tv-Tuner Card

meowsqueak · Posted: Wed Oct 29, 2003 12:43 am Post subject:

You could use grc perhaps - app-misc/grc

TobiWan · Posted: Wed Oct 29, 2003 2:18 pm Post subject: Re: help: I MAY be hacked

persia · Posted: Wed Oct 29, 2003 9:26 pm Post subject: Thnx Tobi

Hi Tobi

thnx alot, very clear answer. I appreciate. Today i spoke to my school "frirends"

and yes i was hacked. Before it was always on saturday morning but they ve changed policies and decided to do some overwork.....
(ah at least they dont change anything or do any damage)

At the university where we can print for free:
I am now a pride owner of some hunderds of pages info on security, iptables, sniffers etc.... I have a load to read i think.

professorn · Posted: Wed Oct 29, 2003 9:31 pm Post subject:

IDS = Intrusion Detection System

If they got static ip, block it?

persia · Posted: Wed Oct 29, 2003 9:34 pm Post subject: founded

Just found it thnx

btw sorry for the many grammar and spelling faults and edits
_________________
P4-2400mhz - 512MB Samsung(2700)
Asus P4PE - GForce TI 4200 POV 128MB -
Western Digital 80&120GB 7200rpm 8 MB Cache
Realtek NIC (BCM 4400) & Logitech MX500
BrookTree 878 Tv-Tuner Card

professorn · Posted: Wed Oct 29, 2003 9:45 pm Post subject:

And btw, consider doing a fsck on /dev/your/frineds/brain

persia · Posted: Wed Oct 29, 2003 9:57 pm Post subject: huh?

man fsck : i understand, but then the rest ?
_________________
P4-2400mhz - 512MB Samsung(2700)
Asus P4PE - GForce TI 4200 POV 128MB -
Western Digital 80&120GB 7200rpm 8 MB Cache
Realtek NIC (BCM 4400) & Logitech MX500
BrookTree 878 Tv-Tuner Card

TobiWan · Posted: Wed Oct 29, 2003 9:57 pm Post subject: Re: Thnx Tobi

Hi,

TobiWan · Posted: Wed Oct 29, 2003 10:09 pm Post subject:

barlad · l33t Joined: 22 Feb 2003 Posts: 673

By the way, I always wondered how someone could hack into a personal linux box that is not running any service. Sure, you can impersonate, fake, flood or whatever else you want but cracking into the box?
How the hell do you do that? there is nothing to exploit!

professorn · Posted: Wed Oct 29, 2003 10:18 pm Post subject: Re: huh?

persia · Posted: Wed Oct 29, 2003 10:32 pm Post subject:

a little history
before i ve used suse and red hat but i did nt like these distro's at all. (suse is horribly slow, red hat : not really free and the search for dependencies is a drag for a noob)

My collagues ( the univ. friends i was talking about) convinced me to get linux, they advised Debian and one them slackware. I choose instead gentoo, because i liked the portage idea.

So i am now here satisified and pride with my achievment (Gentoo installed from level 1). But then i run into trouble.
Today i was complaining, about i had troubles with Linux and that it freezes up sometimes. And the guys start laughing.... and start asking if it was late in the night? Then i knew the bastards were acting like clowns again....

But what i dont understand either is this: We have Xp&Linux machines but also some older Sparc models. 5 and 10 if i am not mistaking. One of the guys who is really into linux and always is talking about his debian told me that he could log me out any time! (while we were programming ont he sparcs) So i asked him to do this. So he logged from a machine next to me into my machine (i did "WHO" and i could see him) and bang .. i was logged out??
.p.s. they would nt tell how they did it.
_________________
P4-2400mhz - 512MB Samsung(2700)
Asus P4PE - GForce TI 4200 POV 128MB -
Western Digital 80&120GB 7200rpm 8 MB Cache
Realtek NIC (BCM 4400) & Logitech MX500
BrookTree 878 Tv-Tuner Card

persia · Posted: Wed Oct 29, 2003 10:35 pm Post subject:

arrrgggg

ok i think i am being hacked again. Had to log in again while i was writing the last messages. I lost control of my keyboard but everything else worked.......
_________________
P4-2400mhz - 512MB Samsung(2700)
Asus P4PE - GForce TI 4200 POV 128MB -
Western Digital 80&120GB 7200rpm 8 MB Cache
Realtek NIC (BCM 4400) & Logitech MX500
BrookTree 878 Tv-Tuner Card

professorn · Posted: Wed Oct 29, 2003 10:39 pm Post subject:

You better get your IP tables up fast, or use the gentoo live cd if your forced because i think it has iptabeles, not sure but a friend of mine told me it has

persia · Posted: Wed Oct 29, 2003 10:42 pm Post subject:

i did emerge iptables, i have compiled my kernel again with netfilter support. Now i have tried iptables -L but i get this:

persia · Posted: Wed Oct 29, 2003 10:48 pm Post subject: Bastille

Hello Tobi

i checked the webiste of bastille but i see no! documentation! How is this possible ? Is it very convinient to configure or what ????
_________________
P4-2400mhz - 512MB Samsung(2700)
Asus P4PE - GForce TI 4200 POV 128MB -
Western Digital 80&120GB 7200rpm 8 MB Cache
Realtek NIC (BCM 4400) & Logitech MX500
BrookTree 878 Tv-Tuner Card

persia · Posted: Wed Oct 29, 2003 11:01 pm Post subject:

100%hound_dog · n00b Joined: 01 Oct 2003 Posts: 32

Not sure how you could have been hacked network wise if you had no services running. Now on the other hand if your Friends(?) had access to your computer they could have done about anything they wanted to. Do you have a bios password? Is your computer set to boot from the CD or floppy if one is loaded? If your computer is not bios password protected and is set to boot first from cdrom any joker could do anything they wanted to your system if they had access to it.
Tripwire - tripwire is indespensible as far as I am concerned. It is actually quite easy to install, just make sure you are doing it on a new, clean install or thier is really no point. With tripwire you will easily be able to see if anyone modifies, replaces ,deletes your files. Just emerge the ebuild, then cd /etc/tripwire and run the install script you see. Next tripwire -m i , this is to create the database. To read the tripwire files that will be created in /var/lib/tripwire/report use twprint -m r -r (whatever the file you want to read). That is it. A small price to pay for peace of mind.
Iptables- Compile Netfilter support into your kernel, and get ready to learn whatever method of rule creation you want to use ( shorewall, firewall builder, or if your like me just create your own firewall scripts and add them to the local startup file.
Chkrootkit- this seems like a good idea, just check for log file deletions, trojans, and such. I don't have much experience with it but it seems like a goodl idea.
Just keep playing and learning, and watch out for those friends of yours.
_________________
When hunting monsters one should take care not to become one.