The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
0answers
57 views

CentOS Server possibly hacked [duplicate]

I have a CentOS 6.3 Web Server and I believe it has been compromised. In my website, I load a couple of Script tags in each page as you can see here: <script type="text/javascript" ...
0
votes
0answers
55 views

Nginx error: “File not found”…coming from someone else's domain

I set up nginx to serve from an Ubuntu EC2 instance a few days ago, and today I checked the error logs when I encountered 504 after 504 in the browser. I found the following in my error.log: ... ...
0
votes
1answer
61 views

Debian hacked via Tomcat Manager [duplicate]

After Tomcat installation, before I even changed the default Tomcat Manager password, the attacker used Tomcat Manager to deploy his own software. Probably some DDOS tools and a file manager. I've ...
0
votes
0answers
54 views

Wordpress + nginx (post compromise), best way to block POST request for random php script?

Due to an outdated plugin, one of the domains that I host on my VPS was compromised and there were bots POSTing to //listTT9.php in order to send mail. The plugin was updated, I've gone through all ...
1
vote
0answers
17 views

Fedora Core 9 Being Hacked? [duplicate]

I think I have a system compromise, with sudden perl process starting at the background with the same user as apache (daemon). I found today ZMUIE, which was script to do some sort of bruteforce ...
0
votes
1answer
259 views

How are SMTP AUTH credentials stolen and how to prevent it?

We run a mail system for some thousands users and from time to time we get a spam flood from one of our users' account. When that happens we see connections from multiple IP addresses of foreign ...
0
votes
2answers
259 views

Active directory auth to comprimised machine?

Let's say that I have a machine on my domain that has been compromised by an unknown attacker. If I use my domain credentials to log into that machine remotely, via RDP, does that expose my ...
0
votes
2answers
368 views

how to check if my root server was compromised

My provider sent me an email stating that my root server seems to have been misused for attacking other systems. How do I check if this is true and my system is compromised? I was told I have 4 days ...
2
votes
2answers
79 views

Disabling a compromised user account

I have a simple question for you, well, at least, much simpler than "How do I clean up a compromised user account?" The question is: "How do I disable a compromised user account?" There are some ...
3
votes
3answers
1k views

Amazon EC2 instance possibly Compromised

I have an EC2 instance that may have been compromised. The instance responds far too slowly as of last week and recently I've checked the httpd access_logs and they are in excess of 11Gigs, despite ...
1
vote
1answer
552 views

exploit.so dmesg errors

A server (which has since been pulled offline and is scheduled to be wiped) was compromised through ssh brute force. No root/su/sudo access was gained but I started observing these errors (pasted ...
0
votes
1answer
104 views

Openvpn Compromise scenario

Scenario : 2 Certification Authorities used for Openvpn - one CA for client certs and another CA for server certs. Question : Say the CA handing out client certificates is compromised - assuming a ...
1
vote
1answer
326 views

Our Server Rooted but exploit doesnt work?

My friend's hosting server got rooted and we have traced some of attacker's commands.. We've found some exploits under /tmp/.idc directory.. We've disconnected the server and are now testing some ...
1
vote
1answer
93 views

Windows Server 2008 Outbound problem

Our server was compromised a few days ago through a FTP server that we didn't update in time. I think I have it under control now but there's still one issue. Inbound connection are working fine but ...
44
votes
6answers
3k views

Reinstall after a Root Compromise?

After reading this question on a server compromise, I started to wonder why people continue to seem to believe that they can recover a compromised system using detection/cleanup tools, or by just ...