sigh.

[rmd]

my home machine got rootkitted over the weekend. must rebuild tonite.

Comments

[muffyjo]

that's a bad thing, right? Oh dear.

[sparkymonster.livejournal.com]

Apply bourbon to yourself while doing so.

[ceo]

Oh, suck. :-(

On that subject, can you recommend a tool for detecting whether one has been rootkitted? I think I should keep a closer eye on my machine than I do.

[coraline]

me too :/

[deguspice.livejournal.com]

I'm not a Linux person, but I've heard people talk about using Tripwire to detect changed files. I think it does a checksum of important files and then periodically it recomputes the checksums and looks to see if anything has changed.

[frotz.livejournal.com]

this (http://www.chkrootkit.org/) can be handy for the garden-variety varieties.

[rmd.livejournal.com]

for redhat, "rpm -Va" checks all rpm-installed files and verifies them. look for the "5" in the status field on things like ls, ps, and netstat. that's a big danger sign.

blatant things that happened to me were my password getting changed on remote machines and local syslog files being blown away. also, tcpdump or snoop showing unusual network activity, or nmap (ideally from another machine) finding unusual ports open.

[lillibet.livejournal.com]

Sorry to hear it.

How was Spamalot?!

[smeehrrr.livejournal.com]

Owie. How did that happen?

[cz_unit]

That sucks. What tools were used?

I notice a lot of rooting attempts on alembic, but apparently haxorz have no clue how to crack a NeXTStation anymore.

CZ

[annathepiper]

YEEP! Sorry to hear that, hon; I still grimace at the major pain in the ass it was for us to get murkworks.net back online last summer after it happened to us. :/

[lyonesse.livejournal.com]

bummer! what os/distro, and what rootkit, if you know?

i once had somebody break onto my rh5 box, and spend what appeared to be an hour trying to rootkit it with kits for rh6 - 9. gave me a bit of a laugh, and an excuse to move to debian :)

[candle-light.livejournal.com]

That sucks. Any correlation with the porklips stuff?

[rmd.livejournal.com]

*sigh* yeah. i can't tell for sure, but chances are good that i was the vector in on that. i think they got my password via a hacked ssh on my machine or a password logger or something.

[solarbird]

Ah! Now I know why xR is gone.

We can temphost for you if you need it.

[rmd.livejournal.com]

thanks. if i don't get things fixed tonite, i'll take you up on that.

(i sent mail out to a bunch of folks about it, but i'd mentioned it over the phone to q (since she gets her mail there) and she said she'd tell you over im)