Re: hacked?

2010-04-14 Thread Chuck Swiger
Hi-- On Apr 14, 2010, at 3:56 PM, Steve Franks wrote: I don't have bsdstats or similar that I'm aware of installed, so this smells bad: Firewall is showing repeated attempts from your FreeBSD machine to connect to port 25 (standard SMTP mail port) on a server in Belgium. This implies

Re: hacked?

2010-04-14 Thread Tim Judd
On 4/14/10, Steve Franks bahamasfra...@gmail.com wrote: I don't have bsdstats or similar that I'm aware of installed, so this smells bad: Firewall is showing repeated attempts from your FreeBSD machine to connect to port 25 (standard SMTP mail port) on a server in Belgium. This implies

Re: hacked?

2010-04-14 Thread Steve Bertrand
On 2010.04.14 18:56, Steve Franks wrote: I don't have bsdstats or similar that I'm aware of installed, so this smells bad: You have an incredibly poor sense of smell. Firewall is showing repeated attempts from your FreeBSD machine to connect to port 25 (standard SMTP mail port) on a server

Re: hacked?

2010-04-14 Thread Erik Norgaard
On 15/04/10 00:56, Steve Franks wrote: I don't have bsdstats or similar that I'm aware of installed, so this smells bad: Firewall is showing repeated attempts from your FreeBSD machine to connect to port 25 (standard SMTP mail port) on a server in Belgium. This implies something on your system

Re: Hacked Web Site

2006-05-19 Thread Daniel A.
Don O'Neil wrote: A customer of mine recently had their web site hacked and the index file defaced by Milli-Harekat... http://www.zone-h.org/en/search/what=Milli-Harekat.Org/ Does anyone know the exploit used for this and where to find out about fixing it? I have a feeling it's a brute force

Re: Hacked Web Site

2006-05-19 Thread Kevin Kinsey
Don O'Neil wrote: A customer of mine recently had their web site hacked and the index file defaced by Milli-Harekat... http://www.zone-h.org/en/search/what=Milli-Harekat.Org/ Does anyone know the exploit used for this and where to find out about fixing it? I have a feeling it's a brute force

Re: Hacked? How can I tell what process is sending packets from a particular port (udp/55613)?

2006-05-01 Thread Nils Vogels
Frank Steinborn wrote on 30-04-2006 22:58: boink wrote: Dear FreeBSD, I see outbound packets from udp/55613, one every 5 seconds, to a single non-routable (10) IP, with destination port increasing by 1 with each packet, with expected ICMP Destination net unreachables from an

Re: Hacked? How can I tell what process is sending packets from a particular port (udp/55613)?

2006-04-30 Thread Frank Steinborn
boink wrote: Dear FreeBSD, I see outbound packets from udp/55613, one every 5 seconds, to a single non-routable (10) IP, with destination port increasing by 1 with each packet, with expected ICMP Destination net unreachables from an upstream router. AFAIK, there's no reason for this

Re: Hacked? How can I tell what process is sending packets from a particular port (udp/55613)?

2006-04-30 Thread Glenn Dawson
At 01:52 PM 4/30/2006, boink wrote: Dear FreeBSD, I see outbound packets from udp/55613, one every 5 seconds, to a single non-routable (10) IP, with destination port increasing by 1 with each packet, with expected ICMP Destination net unreachables from an upstream router. AFAIK, there's no

Re: hacked

2004-03-09 Thread Alex de Kruijff
On Tue, Mar 09, 2004 at 02:56:15AM +0800, re re wrote: hello despite having ipfilter blocking all ports except 80 21 and 22, tripwire, and scoring 99 in nmap, my website got defaced. the box is currently unplugged. i wanted to know what is the best way to find out who did it and how

RE: hacked

2004-03-08 Thread Remko Lodder
you should make a copy of your current harddrive, and lock the otherone in a safe or something , so that you can always make additional copy's. This requires a same sized harddisk in a other working system.. But that is propably not what you have, You should check your webserver logs/ftp logs,

Re: hacked

2004-03-08 Thread Ion-Mihai Tetcu
On Sat, 8 Mar 2003 20:02:02 +0100 Remko Lodder [EMAIL PROTECTED] wrote: Please set your date right. tnx -- IOnut Unregistered ;) FreeBSD user ___ [EMAIL PROTECTED] mailing list

Re: hacked

2004-03-08 Thread Ion-Mihai Tetcu
On Mon, 8 Mar 2004 21:22:24 +0200 Ion-Mihai Tetcu [EMAIL PROTECTED] wrote: On Sat, 8 Mar 2003 20:02:02 +0100 Remko Lodder [EMAIL PROTECTED] wrote: Please set your date right. tnx And of course that should have been sent on private. Sorry. -- IOnut

Re: hacked

2004-03-08 Thread Kirk Strauser
At 2004-03-08T18:56:15Z, re re [EMAIL PROTECTED] writes: hello despite having ipfilter blocking all ports except 80 21 and 22, tripwire, and scoring 99 in nmap, my website got defaced. Despite locking my door to my house, pulling the curtains, and sitting in a dark living room with a