Linked Questions

21
votes
15answers
3k views

HELP! Production DB was SQL INJECTED! [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Geeze, I'm desperate! A few hours ago our production DB was sql-injected. I know we have some big holes in the system... because ...
11
votes
11answers
1k views

Site hacked, looking for security advice [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Last weekend my company's site was hacked. They did the nicest thing of doing that on a Friday evening so we only noticed the ...
6
votes
6answers
2k views

Attempted hack on VPS, how to protect in future, what were they trying to do? [duplicate]

UPDATE: They're still here. Help me stop or trap them! Hi SF'ers, I've just had someone hack one of my clients sites. They managed to get to change a file so that the checkout page on the site ...
9
votes
6answers
754 views

Is my web server being compromised? [duplicate]

We logged remotely into our CentOS server today using Putty, and while wandering through previous commands using the up arrow, stumbled across the following: unset HISTFILE mkdir /usr/lib/tmp cd ...
12
votes
3answers
1k views

Has my Linux server been compromised? How do I tell? [duplicate]

Running (X)Ubuntu 10.04.2 LTS behind a router. I just received an email from my root account on that machine, with the following subject: *** SECURITY information for <hostname>: The ...
4
votes
4answers
12k views

How to find which script on my server is sending spam emails? [duplicate]

My server is sending the spam email and I am not able to find out which script is sending them. The emails were all from nobody@myhost so disabled from the cpanel that nobody should not be allowed ...
3
votes
6answers
2k views

I think my server is being hacked. What should I do? [duplicate]

I'm not a server admin and I have very little experience in "debuging" a server. But from looking at my log files, it looks as if I'm being hacked. But I have no clue to what I should do :-/ I was ...
2
votes
4answers
2k views

I just got a linode VPS a week ago and I've been flagged for SSH scanning [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY I got a 32-bit Debian VPS from http://linode.com and I really haven't done any sort of advanced configuration for securing it ( port ...
1
vote
5answers
2k views

Server Potentially Compromised — c99madshell [duplicate]

So, low and behold, a legacy site we've been hosting for a client had a version of FCKEditor that allowed someone to upload the dreaded c99madshell exploit onto our web host. I'm not a big security ...
3
votes
2answers
900 views

Rootkit Revealer is failing to run, why? [duplicate]

On a user's laptop (Windows 7 x64), terrible performance led me to suspect a rootkit after ruling almost everything else out. I checked boot entries with Autoruns and ran a full scan with ...
2
votes
5answers
2k views

.htaccess being hacked repeatedly [duplicate]

About 4 or 5 days ago, a client came back to me saying that their site was being redirected to some other suspicious looking website from Google, Yahoo, etc., but it was working fine when the user ...
2
votes
5answers
2k views

Finding out who hacked my site [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY All Joomla! sites hosted on a single server of mine were hacked and had the following code injected into the index.php files ...
3
votes
1answer
2k views

Linux Server hacked? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I'm trying to determine if this linex webserver/openfire server has been compromised by some form of malware or a hacker. Can you ...
-1
votes
2answers
835 views

My MySQL database is getting hacked nonstop [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY My MySQL database is getting hacked daily. Hackers are uploading shell and files in others cpanel to the server, and getting the ...
3
votes
1answer
4k views

/usr/bin/host being used in HTTP DDoS on Debian? [duplicate]

So I got an abuse complaint for one of my dedicated servers, running Debian 6.0 Sure enough, sometimes, top shows /usr/bin/host using a lot of CPU for no apparent reason, and netstat shows process ...

15 30 50 per page