[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Server Hacked

To: or-talk@xxxxxxxxxxxxx
Subject: Server Hacked
From: Brian C <brianwc@xxxxxxxxxxxxxxxx>
Date: Thu, 18 Aug 2005 22:39:13 -0700
Delivered-to: archiver@seul.org
Delivered-to: or-talk-outgoing@seul.org
Delivered-to: or-talk@seul.org
Delivery-date: Fri, 19 Aug 2005 01:41:29 -0400
Reply-to: or-talk@xxxxxxxxxxxxx
Sender: owner-or-talk@xxxxxxxxxxxxx
User-agent: Debian Thunderbird 1.0.2 (X11/20050602)

My Debian server has been hacked. Every web page I hosted now reads:

"XTech Inc Was Here :D"
XTech Inc we are: Status-x & PABLIN77
uid=0(XTech Inc) gid=0(XTech Inc) groups=0(XTech Inc)
Pablin77: MARY TE AMO!!!!!!

Powered by XTech Inc / PABLIN77
Made in ARGENTINA - pablin_77@xxxxxxxxxxxxx

I run Debian-testing and generally stay on top of updates. I do run a
few too many services on that server though. I wonder if my recent
addition of making it a tor server is what brought my humble server to
these jerks attention? I've little experience with recovering from this,
so any advice on what steps to take from here, what log files are
relevant, etc. would be greatly appreciated.

Brian

Follow-Ups:
- Re: Server Hacked
  - From: ADB
- Re: Server Hacked
  - From: Peter Palfrader

Prev by Author: Re: (FWD) Re: OS X Client and Privoxy 503 error
Next by Author: Re: Server Hacked
Previous by thread: Re: bad security setting for win32 tor service
Next by thread: Re: Server Hacked
Index(es):
- Author
- Thread