The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
0answers
17 views

Fedora Core 9 Being Hacked? [duplicate]

I think I have a system compromise, with sudden perl process starting at the background with the same user as apache (daemon). I found today ZMUIE, which was script to do some sort of bruteforce ...
0
votes
1answer
199 views

How are SMTP AUTH credentials stolen and how to prevent it?

We run a mail system for some thousands users and from time to time we get a spam flood from one of our users' account. When that happens we see connections from multiple IP addresses of foreign ...
0
votes
2answers
250 views

Active directory auth to comprimised machine?

Let's say that I have a machine on my domain that has been compromised by an unknown attacker. If I use my domain credentials to log into that machine remotely, via RDP, does that expose my ...
0
votes
2answers
319 views

how to check if my root server was compromised

My provider sent me an email stating that my root server seems to have been misused for attacking other systems. How do I check if this is true and my system is compromised? I was told I have 4 days ...
2
votes
2answers
79 views

Disabling a compromised user account

I have a simple question for you, well, at least, much simpler than "How do I clean up a compromised user account?" The question is: "How do I disable a compromised user account?" There are some ...
3
votes
3answers
841 views

Amazon EC2 instance possibly Compromised

I have an EC2 instance that may have been compromised. The instance responds far too slowly as of last week and recently I've checked the httpd access_logs and they are in excess of 11Gigs, despite ...
1
vote
1answer
510 views

exploit.so dmesg errors

A server (which has since been pulled offline and is scheduled to be wiped) was compromised through ssh brute force. No root/su/sudo access was gained but I started observing these errors (pasted ...
0
votes
1answer
99 views

Openvpn Compromise scenario

Scenario : 2 Certification Authorities used for Openvpn - one CA for client certs and another CA for server certs. Question : Say the CA handing out client certificates is compromised - assuming a ...
1
vote
1answer
320 views

Our Server Rooted but exploit doesnt work?

My friend's hosting server got rooted and we have traced some of attacker's commands.. We've found some exploits under /tmp/.idc directory.. We've disconnected the server and are now testing some ...
1
vote
1answer
93 views

Windows Server 2008 Outbound problem

Our server was compromised a few days ago through a FTP server that we didn't update in time. I think I have it under control now but there's still one issue. Inbound connection are working fine but ...
43
votes
6answers
3k views

Reinstall after a Root Compromise?

After reading this question on a server compromise, I started to wonder why people continue to seem to believe that they can recover a compromised system using detection/cleanup tools, or by just ...