Forum OpenACS Q&A: Security: Hacker sends Viruses

Seriously, did they get shell access?

If not, and if you're not running Postmaster with -i and an externally  visible IP, you should be OK regarding PG.

And if they didn't gain shell access AOLserver should be fine, too.

If they got shell access, they very likely got root access.  At least, you should presume they did.  Even if they didn't, the user account they logged in under might have access to PSQL and the database.  So in theory they might've gone in and played with database tables.

I rather doubt it, though.  One advantage of using relatively unknown AOLserver and PG (as compared to Apache and MySQL) is that your typical unskilled script kiddie won't know what they are or how to screw it up.

I'd be more worried about them having had root access and loaded a bunch of standard rootkit stuff with all sorts goodies that let them take over your system whenever they want.

Did they get shell access

Apparently so... they created a "moonx" mailbox which I deleted a few days ago along with changing the root password. Apparently they haven't messed with AOLserver or PG... er...yet.

I'm having "X" check things out here shortly....
Thank you.

-Bob

Can I have a copy too?

I discovered something on the latest submission to our list. I set up the list so that I'm the only one to get the messages.. This hack may not need shell or root access. It may be a majordomo hole... All the messages sent appear to come from "owner-..." So perhaps they hacked the list password... Anywhay here is part of the header. Can I assume he/she is using a compaq and connected using 162.39.57.35 I did a lookup: Central Telephone Co. in LittleRock AR USA. Am I on the right track?
-Bob

Delivered-To: rocon-rocnet:com-zzztgn@rocnet.com
From: owner-thebulletin@greatestnetworker.com
Received: from compaq ([162.39.57.35])
by www.greatestnetworker.com (8.9.3/8.9.3) with SMTP id RAA00783
for ; Tue, 6 Feb 2001 17:08:03 -0500

Date: Tue, 6 Feb 2001 17:08:03 -0500
Message-Id: <200102062208.RAA00783@www.greatestnetworker.com>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="--VEXAFWTYJCTE7WTAB"
Subject: [The Bulletin:07] Message for thebulletin
Sender: owner-thebulletin@greatestnetworker.com
Precedence: bulk
Reply-To: owner-thebulletin@greatestnetworker.com
X-UIDL: 3Y`!!'

Concerning Red Hat: you can probably sign up on the appropriate mail lists at https://listman.redhat.com/mailman/listinfo/ (Redhat-announce-list or Redhat-watch-list) for security bulletins and update RedHat RPMs.

Some MTAs are vulnerable to certain hacks:

• Execute arbitrary command: RCPT TO: |testing
• Execute arbitrary command: MAIL FROM: |testing
• Overwrite files: RCPT TO: /tmp/mail_test
• Allow remote users to send mail anonymously by sending HELO commands longer than 1024 characters
• Redirection: mail addressed to user@hostname1@victim will send to user@hostname1

The other classic MTA configuration snafu is to allow mail relaying.

I'm certainly no security expert, but one might start off by

• Installing OpenSSH
• Disabling inetd (rsh, rlogin, telnet, ftp, etc.) ASAP - shut it down and never let it start up again. Period.
• Running the Nessus security scan on your system to find out the egregious security holes
• Optional but highly recommended: replace your MTA with qmail

Webmin is not secure straight out of the box. There are notes on their website about using it with SSL. Of course, the secure Webmin point is moot if you have other security holes that let people have root access.

The best advice is having whoever is setting up your new secure server run a security sweep on the compromised box. Good luck.

I wrote it as an afternoon project. I was unaware of the perl package referenced above (until reading this thread again today). My script is pure Tcl, so it should be easily customized by folks here. It uses the Tcl Standard Library ver 0.8 (available at dev.scriptics.com), which I believe requires Tcl 8.2 or greater(?). (I use Tcl 8.3.2 since that's what AOLserver 3.x has internally.)

I've thrown the script up at http://michael.cleverly.com/aolserver/emdia. The name, EmDia is a Portuguese idiom for "current" or "up-to-date". Running emdia -? will give you a list of all the command line options & their default values.

Could you quickly write down some steps for beginners how you get emdia working?

I didn't find anything on your webpage...