Just read a great article by Tim O’Reilly Piracy is Progressive Taxation on publishing and how it’s affected (and not affected) by Internet ‘piracy’, and digital distribution. Very appealing, libertarian-esque view I think.
My server was compromised last week due to the OpenSSL vulnerability which I’d opened up for secure webmail.
Fun fun fun, here’s the relevant log entry:
[Thu Jul 24 21:31:15 2003] [error] [client 218.150.223.238] File does not exist: /var/www/sumthin
[Thu Jul 24 21:32:11 2003] [error] mod_ssl: SSL handshake failed (server caemlyn.thadk.net:443, client 218.150.223.238) (OpenSSL library error follows)
[Thu Jul 24 21:32:11 2003] [error] OpenSSL: error:1406908F:SSL routines:GET_CLIENT_FINISHED:connection id is different
[Thu Jul 24 21:34:26 2003] [error] mod_ssl: SSL handshake failed (server caemlyn.thadk.net:443, client 218.150.223.238) (OpenSSL library error follows)
[Thu Jul 24 21:34:26 2003] [error] OpenSSL: error:1406908F:SSL routines:GET_CLIENT_FINISHED:connection id is different
[Thu Jul 24 21:52:39 2003] [error] [client 216.39.48.171] File does not exist: /var/www/employ/index.html
Looks as somehow I got a slightly updated version of the OpenSSL library somehow through apt-get but only the version included with the stable debian distribution was being updated for security patches. Yuk.
Luckily it appears all clean now, the automated attacker sqrewed up in two ways:
- His email account was shut down so the automated attack-report email was mailer-daemon returned-to-sender.
- As if that wasn’t obvious enough, his script changed the root password and added another user (volvo uid:0) but failed to remove sudoers or remove ~/.ssh keys
- The steps to cover up file changes wern’t made, I just pulled up Knoppix and searched for all files changed since the above time and easily nuked all of the offending files. I even saved a copy for forensics purposes.
I found that many of my /bin/* files were replaced with equivilents infected with the rst.b linux virus, what appeared to be some cracking utilities in /usr/lib/unamed, a covert ssh server in /usr/lib/xsf hosting behind port 1003 with a password of 123 and a psybnc tgz (IRC bouncer) in /var/tmp.
And now I’ve been made appropriately paranoid about security.
