Is my machine pwnd?

runningwithscissors · Posted: Sat Oct 20, 2007 8:17 am Post subject: Is my machine pwnd?

This morning, I saw the lights on my router blinking like crazy so I ran a netstat and there were a few connections being established to one particular addresses. I immediately banned the address, and all the connections died. However, I am not sure if my linux machine is pwnt or the older one behind the Linux machine that runs Windows.

ps ax shows this.

justwantstohelp · Posted: Sat Oct 20, 2007 8:28 am Post subject:

all those kde processes look suspicious
_________________
We need to shoot cops, and hang politicians. Concentrate the vision, concentrate the vision.

Pithlit · l33t Joined: 27 Dec 2003 Posts: 887 Location: fuhen

He started 2 kde sessions, that's why there's so many of them.

Other than that there's no way of telling with this little info. Did you start 2 sessions? Did you start lighttpd? Why do you even suspect you're getting "pwned"? etc etc...
_________________
If someone solves a problem for you say thanks... and put [SOLVED] in the title!

petrjanda · Posted: Sun Oct 21, 2007 4:50 am Post subject:

you should have saved a tcpdump before you cut those connections, that way we could identify what kind of trafic was being transfered, whether it was a threat or not.
_________________
There is, a not-born, a not-become, a not-made, a not-compounded. If that unborn, not-become, not-made, not-compounded were not, there would be no escape from this here that is born, become, made and compounded. - Gautama Siddharta

bunder · Bodhisattva Joined: 10 Apr 2004 Posts: 5947

Security related, moved from Off the Wall to Networking & Security.

have you considered installing rkhunter or chrootkit? i don't see anything out of the ordinary, but if you're paranoid, it's probably a good start along with tcpdump.

cheers
_________________

runningwithscissors · Posted: Sun Oct 21, 2007 5:24 am Post subject:

cokey · Advocate Joined: 23 Apr 2004 Posts: 3355

well you have 2 X sessions which is probably the 2 KDE sessions, JFS being loaded up by the kernel so i hope that is your fs.

There is one thing that stands out to me and that is the two ssh sessions. Either you have started both or that is someone else starting one and allowing another to be brought it by way of rootkit and discovering/changing passwords but without a packet dump you won't know what is being sent.

Be safe and run a packet sniffer for the next couple of days and if you see anything strange log the times and post it
_________________
https://otw20.com/ OTW20 The new place for off the wall chat

Hu · Administrator Joined: 06 Mar 2007 Posts: 23081

If you remember the foreign address or the ports involved, please post those. Also, please show us your iptables rules. You can print them all by running iptables-save -c. Consider modifying the rules which banned the suspicious hosts so that you get log records for any future contact. Use -d suspicious-foreign-host -m limit --limit 5/min -j LOG --log-prefix "FW-LOG-suspicious " --log-ip-options --log-tcp-options in the chains where you have a DROP rule. Then watch your firewall logs for anything with that prefix.

You might also find net-analyzer/iptstate useful. It shows both connections originating from the box (like netstat) and connections forwarded through the box.

runningwithscissors · Posted: Sun Oct 21, 2007 8:03 pm Post subject:

Hu · Administrator Joined: 06 Mar 2007 Posts: 23081