Re: debian wheezy i386 nginx iframe rootkit

2013-09-12 Thread E Frank Ball III
On Thu, Sep 12, 2013 at 07:15:57PM +0900, Joel Rees wrote: The lynx webrowser shows this as the first line of the webpages: Local on the machine in question or external? external. IFRAME: http://122.226.137.123:/yixi.exe It also appears in downloads using wget. view

debian wheezy i386 nginx iframe rootkit

2013-09-11 Thread E Frank Ball III
Last fall there was a debian 64-bit / nginx rootkit going around, now I've been hit with what sounds similar but on 32-bit wheezy. Here's a link to info on the previous 64-bit rootkit: https://www.securelist.com/en/blog/208193935/New_64_bit_Linux_Rootkit_Doing_iFrame_Injections All files served

Re: debian wheezy i386 nginx iframe rootkit

2013-09-11 Thread E Frank Ball III
On Thu, Sep 12, 2013 at 09:13:46AM +0900, Joel Rees wrote: On Thu, Sep 12, 2013 at 7:48 AM, E Frank Ball III fra...@efball.com wrote: Last fall there was a debian 64-bit / nginx rootkit going around, now I've been hit with what sounds similar but on 32-bit wheezy. All files served

Re: idea: switch default MTA from exim4 to postfix (wheezy+1)

2012-11-01 Thread E Frank Ball III
On Thu, Nov 01, 2012 at 05:35:57PM +0100, Milan P. Stanic wrote: On Thu, 2012-11-01 at 12:03, Axel Caspard wrote: I am curious to know why you would like to see bind replaced with dbndns? The same as for exim: security records. The first thing I do on a Debian installation is rip out