hacked?

nadamsieee · Posted: Tue Feb 03, 2004 12:29 am Post subject: hacked?

A friend, who is a Gentoo newbie, complained today that his KDE and cable modem were suddenly very slow. I decided to nmap his computer and this is the output:

imsdunn · n00b Joined: 06 Sep 2003 Posts: 19

More information

imsdunn · n00b Joined: 06 Sep 2003 Posts: 19

Here is some more info that might help. I ran chkrootkit

pakman · Tux's lil' helper Joined: 06 Jan 2004 Posts: 100

Those filtered ports could be due to the ISP blocking them, quite likely at the moment to limit worms spreading via the windows fileshares (on the 135-139 ones). Was the scan done at a different time to that netstat output, because ssh doesn't show up on the netstat but does on the scan, which is possibly worrying. It could indicate the netstat has been trojaned, or that ssh was stopped between the two.

btw: probably best to nmap -p 1-65535 <ip> to make sure it scans all ports, default is to skip quite a few...any hacker activity is likely to be on a high port that nmap misses on its default scan. Notice this bit:

nadamsieee · Posted: Tue Feb 03, 2004 2:10 am Post subject:

nadamsieee · Posted: Mon Feb 09, 2004 1:10 am Post subject:

I rescanned Sean's computer tonight:

D. M. P. inc · Posted: Mon Feb 09, 2004 3:14 am Post subject:

a few reasons computers and ineternet is slow

computer been up for a while. didnt reboot cable for a while too (sometimes when isp update there server, the cable box try to update but there is conflicts. try rebooting everything coz this is the basic problem.
_________________
Live And Learn.

zeky · Posted: Mon Feb 09, 2004 9:10 am Post subject:

If nmap says port is filtered it means that something is blocking it on the way (and that way would be from your PC where you run nmap thrue some or more ISPs to the destination PC that you're scanning). It doesn NOT necessery means that this port is opened and filtered on your box.
_________________
Beat your dick like it owes you money

ed0n · Posted: Mon Feb 09, 2004 9:40 am Post subject:

If I will see that output of the nmap I will not say that somebody broked
on his box. If you want to know if somebody broked to your box
you need to be fast and always check the logs and backup your system.

converter · Apprentice Joined: 24 Dec 2002 Posts: 163

imsdunn · n00b Joined: 06 Sep 2003 Posts: 19

nadamsieee · Posted: Thu Feb 12, 2004 2:18 am Post subject:

imsdunn's machine failed to boot, and he is using fsck (on his Gentoo CD) to check the partitions as I type this. fsck has found several errors thus far. So chalk this one up to a bad hard drive.

Thanks again to everyone who helped!
_________________
nadams (at) ieee (dot) org