Hacking is the violation of server or network security via exploitation of weaknesses in that security.

learn more… | top users | synonyms (4)

-2
votes
1answer
777 views

Has my server been hacked? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I have some problem with my server (running on Centos 5). While checking traffic, I run "$lsof | grep ezbuyinfo" and it show too ...
3
votes
4answers
2k views

Is this server hacked or just login attempts ? See log

Can someone tell what does this mean? I tried a command like lastb to see last user logins and I see some strange logins from China (server is EU, I am in EU). I was wondering if these could be login ...
-1
votes
1answer
424 views

.htaccess attack redirect all the sites in the server [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY My site is hacked and I've asked yesterday about this issue. I've changed the FTP password, the server password. I also have ...
-1
votes
2answers
227 views

My Wordpress site being hack by modifying the .htaccess [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I'm going crazy right now and I don't know what to do. I've did a Google search about those hackers where they using .htaccess to ...
1
vote
1answer
502 views

Plesk Qmail Queue Exploding From Possible Webform Attack

The qmail queue on my server (running Plesk on CentOS 5.2) balloons up to 120,000+ messages in the queue overnight. The messages in the queue are obviously spam. I've cleared them out over the last ...
4
votes
3answers
2k views

Could this server log mean my server is being used as a proxy?

I came across the following entry in my access.log: 58.218.199.147 - - [05/Jun/2012:12:56:04 +1000] "GET http://proxyproxys.com/ HTTP/1.1" 200 183 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT ...
-4
votes
1answer
260 views

windows Server is hacked by SOG how any one please help me? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY my server is Win2K8 Web SRV , IIS-7, it is a web hosting server & my sites was hacked by someone it is hacked by SOG say's ...
-3
votes
1answer
141 views

How do I go about getting my system hacked? [closed]

I have a project that will eventually be posted as a public service online. Security is a big concern, and I don't have a lot of experience hardening systems and code for public scrutiny. Is there ...
0
votes
3answers
2k views

apache2 server logs - weird activity?

I was going through apache log, and I thought some of the access logs seemed suspicious... I'm not pro, just do server administration as hobby :) so I wonder if I should take some steps... ...
2
votes
1answer
133 views

Potential Bot-Net organizers probing for new machines?

I'm getting a number of exploit attempts from different IP's today. GET ...
0
votes
1answer
70 views

Periodic DNS Fault

I have a reseller account. but sometimes, somthings goes wrong on my websites. I think server is hacked or DNS server is hacked. I searched similar content on google, then I found same HTML codes on ...
0
votes
1answer
1k views

Logwatch httpd - hacks and probes

Sometimes in my daily logwatch report, I notice that there is a section under httpd for "attempts to use known hacks..." and another section about how many sites probed the server. I have a few ...
1
vote
2answers
210 views

Is there a way to log who upload or change a spesific file? (centos) [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY There is a file that keeps infected with this code. I can't figure out why. So I want to log who upload or change the file. Is there a ...
5
votes
1answer
796 views

How does Windows hide internal users?

I just recognized that Windows hides some special users, like for example the NT Authority\SYSTEM user or the users which are added after the installation of SQL Server (ReportServer$SQLEXPRESS, ...
0
votes
1answer
239 views

Apache server under attack

I have a CentOS 5.8 server with Apache 2.2.3 with 20 websites on it. The last weeks the server was several times inaccessible (too many database connections and lots of CPU usage). I had to restart ...
-1
votes
2answers
186 views

How to prevent Brute-Fource server attack on Linux base server?

Lately my server goes down many times and I have to reboot it in order to start up again. I use CentOS for my web server and notice an email send from my server log that Brute-Force Attack detected ...
1
vote
2answers
1k views

Websites get hijacked by parking page

Since a couple of weeks the websites on my hosting get hijacked by a webhosting parking page when requesting them. Sometimes it shows my actual website, but a couple of minutes after requesting it, ...
3
votes
1answer
2k views

Linux Server hacked? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I'm trying to determine if this linex webserver/openfire server has been compromised by some form of malware or a hacker. Can you ...
1
vote
1answer
202 views

Apache error_log showing which command output

Apache's error_log shows lines like the following: --- snip --- which: no ruby in (/sbin:/usr/sbin:/bin:/usr/bin) which: no locate in (/sbin:/usr/sbin:/bin:/usr/bin) which: no suidperl in ...
3
votes
2answers
580 views

Apache server redirecting requests from Google, compromised?

I found something very suspicious. When connecting to www.pulseexpress.com following a Google link, the server redirects you to some very dubious site that sends you a .exe file right away: # host ...
1
vote
1answer
293 views

Hacker exploiting Wordpress install

I'm running WordPress on IIS7 on one of my servers. For some reason, a hacker is able to change the read/write permissions on all of the files, and then inject a script tag into the top line of the ...
1
vote
1answer
462 views

Server Hacked + Huge Bandwidth Usage Spike [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I run a couple of sites on Ubuntu via Rackspace Cloud Server. My site typically uses about 3 GB of outbound bandwidth a day. Today, ...
0
votes
4answers
754 views

The more secure iptables script imaginable. Does one exist? [closed]

I plan on buying a server soon. I'd like the server to be as secure as possible, only having POP3, SMTP, SSH and HTTP open. I know how to write an iptables script to only allow those connections and ...
0
votes
2answers
1k views

Auth log error : Is it a Hack?

I was just going through auth.log file, I found the following error. Can anybody tell is it a hack or just log of Bugzilla which I installed & throughing an error. Mar 12 06:50:10 bigbugz02 ...
1
vote
5answers
677 views

Identifying DOS attack [duplicate]

I'm suspecting that one of my servers is attacked some time ago. My question is how can I identify a DOS or DDOS attack while under attack or after the attack has finished?
0
votes
1answer
612 views

Hacked server with IPmech installed in /var/tmp/.aw running cronjob every minute, how do I determine how I was hacked

One of my user accounts on an Ubuntu 10.04.3 server was hacked, and I'm not sure how. The password was strong. A cronjob was installed in my user's crontab running and executable in /var/tmp/.aw The ...
1
vote
1answer
838 views

Backdoor and zmeu process on a Linux system [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY First some background info. The server we're talking about is running CentOS 5.6, SSH on port 22 which can be accessed over the ...
0
votes
1answer
960 views

It looks like somebody is using my Mac OS X server to brute force attack another server which is LDAP. What can I do to stop it?

An LDAP server on another is reporting an unusually large number of attempts to read the LDAP directory and attempting a number of users, all of which look like hacking attempts to read user/password ...
2
votes
1answer
1k views

How can I trick SBS 2011 into allowing me to assign a UPN alias so users can logon as user@domain.com

How can I trick SBS 2011 into allowing me to assign a UPN alias so users can logon as user@domain.com See http://support.microsoft.com/kb/243629/en-us But on SBS I only have a 'General', 'Trusts', ...
3
votes
4answers
690 views

best way to find vulnerabilities on a server hosting a large number of sites?

I've inherited a web server that's been compromised. Trying to figure out why apache was hanging and the causes of high server load, I found several copies of perlbot 4.5 in /tmp. I'm now trying to ...
11
votes
1answer
1k views

ubuntu 10.10 sshd contains “YOU WANNA SMOKE A SPLIFF” and pot leaf ascii art. Does this mean I've been hacked?

My sshd binary on an ubuntu 10.10 machine contains the following ascii artwork: ng: %.100sToo many lines in environment file %sUser %.100s not allowed because %s exists YOU WANNA . ...
0
votes
1answer
68 views

Common ways of spam files ending up in a web directory

A friend discovered a bunch of spam files in his web directory on his web host the other day. He has no idea where they came from, and I'm not quite sure either. What are common security breaches ...
-1
votes
1answer
72 views

Old ubuntu password

I know how to set new password of root in ubuntu 10.04 if I don't know root pasword and grub has no password . I want to know that whether I could get the old password which was set before I changed ...
1
vote
1answer
595 views

Malicious script changing .htaccess files on server [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY There seems to be a malicious script accessing my server and editing the .htaccess files for all of my hosted sites to redirect ...
0
votes
1answer
397 views

.htaccess file being compromised

I have a website hosted with Dreamhost and the contents of my .htaccess file are being compromised over and over again. someone is putting stuff like this in the front of my code: RewriteCond ...
3
votes
3answers
686 views

Recover data from EC2 instance storage

So last week, an instance on EC2 stopped responding, I still don't know exactly why because I can no longer SSH in, I suspect the /tmp/ directory which was mounted to another drive is no longer ...
-2
votes
1answer
152 views

How does Annonymous (or others) hack all of these high profile websites? What are the faults of the server admins? [closed]

In the news in the last 2 years, Anonymous/AntiSEC/etc... has been getting a lot of press for hacking high profile websites: PlayStation Network FBI CIA Bank websites Stratfor etc.... I'd like ...
0
votes
1answer
784 views

What is “/admin/Y-ivrrecording.php?php=info&ip=uname”?

Help me please, I found an IP address from Korea try to do something with my web server by put this '/admin/Y-ivrrecording.php?php=info&ip=uname' like search a filename from my web server. I ...
1
vote
2answers
303 views

How to prevent bombardment of hack attempts on VPS

Ever since I bought a VPS, I have been receiving emails like those shown below since day one, every single day. I was wondering if is this really normal? Is there anyway I can prevent it, or is ...
0
votes
1answer
369 views

Hidden Spam Meta Descriptions

I have found out that a client's site (WordPress CMS) was somehow infected with spam / hacked and did some serious cleaning, updating and upgrading and cleaning cache. I used various tools and search ...
0
votes
2answers
124 views

Kindly help me on how to handle the hacker

I have a website. Somebody is sending thousands of 404 hits to my site. He uses random IPs. he is keep on sending at least 1000+ hits everyday to various urls which doesn't exists in my site. I have ...
-1
votes
1answer
352 views

How do I figure out how the “Pharma Hack” hackers are gaining access to my site?

One of my sites has been the continuous target of the "Pharma Hack" - but it's using Drupal instead of Wordpress or Joomla. It is version 6, but it's updated to the latest version, and so are all of ...
0
votes
2answers
1k views

VPS under DDoS Attacks [duplicate]

Possible Duplicate: Am I getting DDoSed, and what should I about it? I'm using a 2 VPS Servers. My domains was unvailable for some time. 1 hour, Somtimes 30 Minutes, and pages loading was ...
0
votes
1answer
692 views

Please help me decode this Wordpress hack? [closed]

Annotated code is here: http://pastebay.com/145971 Looks like a very similar situation to this post I'm no good with python so I thought I might ask for help here. The hack seems to include an ...
0
votes
2answers
3k views

Postfix still trying to send spam despite closing open relay

I have a small server at home, which has postfix installed. It's only use is to return the results of cronjobs and email out externally for a few other scripts. I use my ISP's mail server as a relay ...
0
votes
1answer
264 views

linux centos 5.6 someone installed irc

I need some help, my server provider contacted me to tell me my server was using 200mbit/s bandwidth. Upon investigation I found processes for a user that should not be there.. I found processes as ...
1
vote
2answers
568 views

Expression Engine Site hacked - Locate redirect [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I have an Expression Engine website I try to clean up. The database has been given many new users so it seems the database has been ...
0
votes
2answers
2k views

Apache/PHP root exploit

Because of insecure handling of uploaded files, an attacker was able to run php code on my server (CentOS 5.4) That issue has been fixed, but while he was connected he appears to have modified a file ...
4
votes
0answers
145 views

Server hacked - want to run an rsync backup in reverse. Will this work? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY My user account on a shared hosting server got hacked and overwrote every PHP with this at the bottom.... ...
-2
votes
2answers
625 views

apache-memory-hacker-linux

We have a linux server with 4Gb of memory. When we start the system it uses only 435Mb. When we start the apache httpd services it take 1000Mb and subsequently automatically it takes all the memory ...