Hacking is the violation of server or network security via exploitation of weaknesses in that security.

learn more… | top users | synonyms (4)

0
votes
1answer
1k views

Logwatch httpd - hacks and probes

Sometimes in my daily logwatch report, I notice that there is a section under httpd for "attempts to use known hacks..." and another section about how many sites probed the server. I have a few ...
1
vote
2answers
187 views

Is there a way to log who upload or change a spesific file? (centos) [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY There is a file that keeps infected with this code. I can't figure out why. So I want to log who upload or change the file. Is there a ...
5
votes
1answer
748 views

How does Windows hide internal users?

I just recognized that Windows hides some special users, like for example the NT Authority\SYSTEM user or the users which are added after the installation of SQL Server (ReportServer$SQLEXPRESS, ...
0
votes
1answer
225 views

Apache server under attack

I have a CentOS 5.8 server with Apache 2.2.3 with 20 websites on it. The last weeks the server was several times inaccessible (too many database connections and lots of CPU usage). I had to restart ...
-1
votes
2answers
169 views

How to prevent Brute-Fource server attack on Linux base server?

Lately my server goes down many times and I have to reboot it in order to start up again. I use CentOS for my web server and notice an email send from my server log that Brute-Force Attack detected ...
1
vote
2answers
861 views

Websites get hijacked by parking page

Since a couple of weeks the websites on my hosting get hijacked by a webhosting parking page when requesting them. Sometimes it shows my actual website, but a couple of minutes after requesting it, ...
3
votes
1answer
2k views

Linux Server hacked? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I'm trying to determine if this linex webserver/openfire server has been compromised by some form of malware or a hacker. Can you ...
1
vote
1answer
192 views

Apache error_log showing which command output

Apache's error_log shows lines like the following: --- snip --- which: no ruby in (/sbin:/usr/sbin:/bin:/usr/bin) which: no locate in (/sbin:/usr/sbin:/bin:/usr/bin) which: no suidperl in ...
3
votes
2answers
554 views

Apache server redirecting requests from Google, compromised?

I found something very suspicious. When connecting to www.pulseexpress.com following a Google link, the server redirects you to some very dubious site that sends you a .exe file right away: # host ...
1
vote
1answer
250 views

Hacker exploiting Wordpress install

I'm running WordPress on IIS7 on one of my servers. For some reason, a hacker is able to change the read/write permissions on all of the files, and then inject a script tag into the top line of the ...
1
vote
1answer
375 views

Server Hacked + Huge Bandwidth Usage Spike [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I run a couple of sites on Ubuntu via Rackspace Cloud Server. My site typically uses about 3 GB of outbound bandwidth a day. Today, ...
0
votes
4answers
711 views

The more secure iptables script imaginable. Does one exist? [closed]

I plan on buying a server soon. I'd like the server to be as secure as possible, only having POP3, SMTP, SSH and HTTP open. I know how to write an iptables script to only allow those connections and ...
0
votes
2answers
1k views

Auth log error : Is it a Hack?

I was just going through auth.log file, I found the following error. Can anybody tell is it a hack or just log of Bugzilla which I installed & throughing an error. Mar 12 06:50:10 bigbugz02 ...
1
vote
5answers
609 views

Identifying DOS attack [duplicate]

I'm suspecting that one of my servers is attacked some time ago. My question is how can I identify a DOS or DDOS attack while under attack or after the attack has finished?
0
votes
1answer
536 views

Hacked server with IPmech installed in /var/tmp/.aw running cronjob every minute, how do I determine how I was hacked

One of my user accounts on an Ubuntu 10.04.3 server was hacked, and I'm not sure how. The password was strong. A cronjob was installed in my user's crontab running and executable in /var/tmp/.aw The ...
1
vote
1answer
732 views

Backdoor and zmeu process on a Linux system [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY First some background info. The server we're talking about is running CentOS 5.6, SSH on port 22 which can be accessed over the ...
0
votes
1answer
876 views

It looks like somebody is using my Mac OS X server to brute force attack another server which is LDAP. What can I do to stop it?

An LDAP server on another is reporting an unusually large number of attempts to read the LDAP directory and attempting a number of users, all of which look like hacking attempts to read user/password ...
2
votes
1answer
959 views

How can I trick SBS 2011 into allowing me to assign a UPN alias so users can logon as user@domain.com

How can I trick SBS 2011 into allowing me to assign a UPN alias so users can logon as user@domain.com See http://support.microsoft.com/kb/243629/en-us But on SBS I only have a 'General', 'Trusts', ...
3
votes
4answers
675 views

best way to find vulnerabilities on a server hosting a large number of sites?

I've inherited a web server that's been compromised. Trying to figure out why apache was hanging and the causes of high server load, I found several copies of perlbot 4.5 in /tmp. I'm now trying to ...
11
votes
1answer
1k views

ubuntu 10.10 sshd contains “YOU WANNA SMOKE A SPLIFF” and pot leaf ascii art. Does this mean I've been hacked?

My sshd binary on an ubuntu 10.10 machine contains the following ascii artwork: ng: %.100sToo many lines in environment file %sUser %.100s not allowed because %s exists YOU WANNA . ...
0
votes
1answer
66 views

Common ways of spam files ending up in a web directory

A friend discovered a bunch of spam files in his web directory on his web host the other day. He has no idea where they came from, and I'm not quite sure either. What are common security breaches ...
-1
votes
1answer
71 views

Old ubuntu password

I know how to set new password of root in ubuntu 10.04 if I don't know root pasword and grub has no password . I want to know that whether I could get the old password which was set before I changed ...
1
vote
1answer
560 views

Malicious script changing .htaccess files on server [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY There seems to be a malicious script accessing my server and editing the .htaccess files for all of my hosted sites to redirect ...
0
votes
1answer
390 views

.htaccess file being compromised

I have a website hosted with Dreamhost and the contents of my .htaccess file are being compromised over and over again. someone is putting stuff like this in the front of my code: RewriteCond ...
3
votes
3answers
611 views

Recover data from EC2 instance storage

So last week, an instance on EC2 stopped responding, I still don't know exactly why because I can no longer SSH in, I suspect the /tmp/ directory which was mounted to another drive is no longer ...
-2
votes
1answer
145 views

How does Annonymous (or others) hack all of these high profile websites? What are the faults of the server admins? [closed]

In the news in the last 2 years, Anonymous/AntiSEC/etc... has been getting a lot of press for hacking high profile websites: PlayStation Network FBI CIA Bank websites Stratfor etc.... I'd like ...
0
votes
1answer
774 views

What is “/admin/Y-ivrrecording.php?php=info&ip=uname”?

Help me please, I found an IP address from Korea try to do something with my web server by put this '/admin/Y-ivrrecording.php?php=info&ip=uname' like search a filename from my web server. I ...
1
vote
2answers
262 views

How to prevent bombardment of hack attempts on VPS

Ever since I bought a VPS, I have been receiving emails like those shown below since day one, every single day. I was wondering if is this really normal? Is there anyway I can prevent it, or is ...
0
votes
1answer
317 views

Hidden Spam Meta Descriptions

I have found out that a client's site (WordPress CMS) was somehow infected with spam / hacked and did some serious cleaning, updating and upgrading and cleaning cache. I used various tools and search ...
0
votes
2answers
122 views

Kindly help me on how to handle the hacker

I have a website. Somebody is sending thousands of 404 hits to my site. He uses random IPs. he is keep on sending at least 1000+ hits everyday to various urls which doesn't exists in my site. I have ...
-1
votes
1answer
327 views

How do I figure out how the “Pharma Hack” hackers are gaining access to my site?

One of my sites has been the continuous target of the "Pharma Hack" - but it's using Drupal instead of Wordpress or Joomla. It is version 6, but it's updated to the latest version, and so are all of ...
0
votes
2answers
1k views

VPS under DDoS Attacks [duplicate]

Possible Duplicate: Am I getting DDoSed, and what should I about it? I'm using a 2 VPS Servers. My domains was unvailable for some time. 1 hour, Somtimes 30 Minutes, and pages loading was ...
0
votes
1answer
634 views

Please help me decode this Wordpress hack? [closed]

Annotated code is here: http://pastebay.com/145971 Looks like a very similar situation to this post I'm no good with python so I thought I might ask for help here. The hack seems to include an ...
0
votes
2answers
2k views

Postfix still trying to send spam despite closing open relay

I have a small server at home, which has postfix installed. It's only use is to return the results of cronjobs and email out externally for a few other scripts. I use my ISP's mail server as a relay ...
0
votes
1answer
254 views

linux centos 5.6 someone installed irc

I need some help, my server provider contacted me to tell me my server was using 200mbit/s bandwidth. Upon investigation I found processes for a user that should not be there.. I found processes as ...
1
vote
2answers
521 views

Expression Engine Site hacked - Locate redirect [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I have an Expression Engine website I try to clean up. The database has been given many new users so it seems the database has been ...
0
votes
2answers
2k views

Apache/PHP root exploit

Because of insecure handling of uploaded files, an attacker was able to run php code on my server (CentOS 5.4) That issue has been fixed, but while he was connected he appears to have modified a file ...
4
votes
0answers
145 views

Server hacked - want to run an rsync backup in reverse. Will this work? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY My user account on a shared hosting server got hacked and overwrote every PHP with this at the bottom.... ...
-2
votes
2answers
570 views

apache-memory-hacker-linux

We have a linux server with 4Gb of memory. When we start the system it uses only 435Mb. When we start the apache httpd services it take 1000Mb and subsequently automatically it takes all the memory ...
0
votes
2answers
343 views

Possible hack attack in Ubuntu Server?

I am having a Ubuntu 10.04 Server with Shorewall 4.4.6. For some days, i have been seeing that the logs shorewall.log, kernel.log and syslog getting to huge sizes above 20G per log. It occupied all ...
2
votes
3answers
122 views

Securing a LAMP host from physical data extraction

This is more of a theoretical question and request for advice and pointers than a question about specific software. I have a distro-agnostic Linux machine (meaning I don't really care what to put in ...
-4
votes
1answer
406 views

Have I been compromised? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Looking thru my logs, I found this: http://paste.u4ik.us/2294$ (The log files are on that paste). Question is, this guy began ...
-2
votes
1answer
81 views

Good tutorial for security on a server [closed]

I previously have had trouble with hackers hacking into servers I was using for web hosting. Does anyone know any good tutorials to prevent it, or perhaps give me some tips on how to increase ...
1
vote
1answer
185 views

Allow nmap advanced scans for a normal user

I want to allow a normal user to run NMAP's advanced scans like XMAS, TCP FIN, TCP NULL scans. Can somebody please tell me how to do that ?? Since it uses raw packets so whether setting the setuid bit ...
-1
votes
2answers
343 views

how to find who is perform malicious activity in shared hosting server

I am a shared webhosting provider, I got a complain: * COMPLAINT * | *.*(server shared ip) | 2011-09-17 20:02:12 | jakarta.dreamhost.com | 1807770 | oscommerce remote upload from ...
0
votes
4answers
167 views

Can MySQL “Query” be exploited (while processing to Server)?

(Not like/about MySQL Injection) I wanna just be confirmed that someone told me a query can be changed (or) modified (by someone intruder/hacker, from middle) while we submitting it. Is it possible? ...
7
votes
2answers
543 views

Dissecting a website attack through a compromised FTP account

My site has been hacked and at this point, I know some details, but I'm at a loss at exactly how it happened or how to prevent it in the future. I need your help in trying to dissect the attack so ...
2
votes
1answer
471 views

Tools to block hack attempts in Apache

Currently I'm using Blockhosts & mod_evasive to "manage" minor attacks & spurious requests, I'm wondering if there is something better/more effective out there. Something that behaves like ...
3
votes
4answers
142 views

Dealing with low level attackers?

I have a small games site with 400 members (~50 active) built around a MySQL database. I'm the sole developer, and I'm an amateur, so I make my fair share of mistakes. To help protect myself, the ...
2
votes
1answer
263 views

Hacking attempt - my server has recently had a hacking attempt. I have the ip address of the attacker

Can I report them to the police ? I am in the UK - is there any type of authority that investigates such matters ?