Linked Questions

0
votes
1answer
322 views

Possible causes for Domain server being unavailable? [duplicate]

Possible Duplicate: Reinstall after a Root Compromise? One of our servers was compromised after a user with administrative privileges accidentally loaded a virus from a USB drive on a ...
298
votes
12answers
52k views

How do I deal with a compromised server?

This is a Canonical Question about Server Security - Responding to Breach Events (Hacking) See Also: Tips for Securing a LAMP Server Reinstall after a Root Compromise? Canonical ...
9
votes
10answers
969 views

Pull network or power? (for contianing a rooted server)

When a server gets rooted (e.g. a situation like this), one of the first things that you may decide to do is containment. Some security specialists advise not to enter remediation immediately and to ...
7
votes
4answers
6k views

/bin/ls not found, even though it exists!

This is a server running ubuntu 8.04 server, any idea what's going on? # ls -bash: /bin/ls: No such file or directory # /bin/ls -bash: /bin/ls: No such file or directory # stat /bin/ls File: ...
9
votes
6answers
740 views

Is my web server being compromised? [duplicate]

We logged remotely into our CentOS server today using Putty, and while wandering through previous commands using the up arrow, stumbled across the following: unset HISTFILE mkdir /usr/lib/tmp cd ...
2
votes
6answers
958 views

How can I audit a Linux filesystem for files which have been changed or added within a specific timeframe?

We are a website design/hosting company running several sites and someone was able to write arbitrary data to the file system. We suspect that they still have some scripts installed and need a way to ...
1
vote
5answers
2k views

Server Potentially Compromised — c99madshell [duplicate]

So, low and behold, a legacy site we've been hosting for a client had a version of FCKEditor that allowed someone to upload the dreaded c99madshell exploit onto our web host. I'm not a big security ...
3
votes
4answers
679 views

best way to find vulnerabilities on a server hosting a large number of sites?

I've inherited a web server that's been compromised. Trying to figure out why apache was hanging and the causes of high server load, I found several copies of perlbot 4.5 in /tmp. I'm now trying to ...
1
vote
1answer
1k views

I've been hacked, and now I'm a bit confused about some things

I noticed yesterday that my site has been hacked, and I'm really confused about some things at this point. All of the files - as far as I can tell - that were edited or added were done so with a ...
0
votes
2answers
196 views

Did My Server Get Attacked?

I logged into my server today and saw the following unrecognized code at the top of my directory browse window: document.writeln("");var el = ...
1
vote
1answer
66 views

Auth.log understand it [duplicate]

I have an ubuntu server and I want to understand if someone enter into it (hacker). I have seen into auth.log many lines like this: May 30 10:36:00 xxx-System-Product_Name CRON[2758]: ...
0
votes
2answers
92 views

Some exploit created irremovable file , what to do?

There are one file uploaded by some exploit. I am not able to delete that file even from root login. What may be the issue how i can delete that, i already check for immutable and stick bit status. ...
0
votes
1answer
47 views

Removing a control kit from the server

The server my site is on was infected using the (pardon my obfuscation) Y-E-S E-x-p-l-o-i-t S-y-s-t-e-m It is a "control kit". I found out some info about it from ...