We got HACKED! - GoFuckYourself.com

Juge · 09-17-2002, 08:05 AM

Our server was hacked. We believe the hacker sniffed a plain text telnet session. No damage has been found.

We were advised to use SSH, but heard it is exploitable through a buffer overflow.

We are running Linux. What software/protocol should we use to access the server?

GFED · 09-17-2002, 08:07 AM

Get F-secure...

HQ · 09-17-2002, 08:15 AM

Quote:

Originally posted by GFED
Get F-secure...

http://www.f-secure.com/products/ssh/ ?

Hooper · 09-17-2002, 08:18 AM

ssh is perfectly secure. the exploit has been patched, but the exploit is largely misunderstood as well.

yes, it's a buffer overflow attack.. but it is one that requires the attacker to *already* be logged into an ssh client..

so they would have to already have a working user/pass in order to use the exploit.

it is largely a problem on shared systems because the attacker can get root priveleges which he/she should not have.

GFED · 09-17-2002, 08:21 AM

Quote:

Originally posted by HQ

http://www.f-secure.com/products/ssh/ ?

Yep... That's what I use... I quit using Hyperterm after I learned about SSH...

here's the d/l page... great program...

http://www.f-secure.com/download-purchase/list.shtml

HQ · 09-17-2002, 08:24 AM

Quote:

Originally posted by Hooper
ssh is perfectly secure. the exploit has been patched, but the exploit is largely misunderstood as well.

yes, it's a buffer overflow attack.. but it is one that requires the attacker to *already* be logged into an ssh client..

so they would have to already have a working user/pass in order to use the exploit.

Interesting. I was suggested to use PuTTy,
http://www.chiark.greenend.org.uk/~sgtatham/putty/, for an SSH client and shut off telnet access to my servers completely. Have you heard of it? If so, how is it?

Dusen · 09-17-2002, 08:45 AM

I acutally prefer putty. I have used SecureCRT, and a few others and I find that putty suits my needs fine, and it's FREE.

I vote use putty.

Dusen · 09-17-2002, 08:47 AM

And ANY ssh client is preferable to Telnet. No matter your reservations about the exploit, remember you were just sending plain text commands to your server.

I don't even have telnet enabled on my boxes.

Jake

High Quality · 09-17-2002, 09:10 AM

SSH is the only thing to use.

Wilbo · 09-17-2002, 09:48 AM

Make sure you disable telnet also, don't just stop using it.

salsbury · 09-17-2002, 09:57 AM

if you are concerned that your telnet session has been sniffed, you need to also stop using FTP and switch to SFTP/FTP over SSH/SCP or something similar. SecureFX supports SFTP.

the reason being, FTP is just as insecure as telnet - it sends passwords in plaintext.

if you do not stop using FTP, you might as well use telnet, too, because you're still just as fucked.

now on to SSH. SSH is more secure, but there have been issues with various versions of it in the past. as is true with any software product, you need to make sure to monitor security lists and install necessary patches. sometimes your host can do this for you, sometimes you need to hire a sysadmin/security admin.

-=HOAX=- · 09-17-2002, 10:05 AM

I use ssh2

L0stMind · 09-17-2002, 10:09 AM

salsbury is correct... you gotta keep up to date on patching.

And just to clear some confusion here, any ssh client is fine, as long as you use ssh. Secure crt, f-secure, putty all use the same protocols... so use any of them, as long as you use ssh.

salsbury · 09-17-2002, 10:47 AM

Quote:

Originally posted by Juge
Our server was hacked. We believe the hacker sniffed a plain text telnet session. No damage has been found.

We were advised to use SSH, but heard it is exploitable through a buffer overflow.

We are running Linux. What software/protocol should we use to access the server?

hi Juge.

friendly advice from a random poster.

you need to either upgrade or find someone to upgrade your Apache and PHP versions. it's as likely that the intruder came in through there as it is that they came through telnet. i see ssh isn't even on the server. if your host told you that they didn't install it because of a buffer overflow bug - switch hosts. today.

crack · 09-17-2002, 10:52 AM

Article:
http://www.wired.com/news/linux/0,1411,55172,00.html
Source:
http://crack.sh/hack/Slapper%20Worm.htm

Juge · 09-17-2002, 10:57 AM

Quote:

Originally posted by Dusen
And ANY ssh client is preferable to Telnet. No matter your reservations about the exploit, remember you were just sending plain text commands to your server.

I don't even have telnet enabled on my boxes.

Jake

I am disabling telnet access.

I was also told to do the same with FTP, and use SCP file transfer. Does anyone here know anything about that?

Juge · 09-17-2002, 10:58 AM

Quote:

Originally posted by Wilbo
Make sure you disable telnet also, don't just stop using it.

Yes, very true. Thanks.

GFED · 09-17-2002, 10:59 AM

Not sure about the SCP file transfer... but F-secure also has a SSH file transfer utility that is pretty sweet...

Juge · 09-17-2002, 10:59 AM

Quote:

Originally posted by salsbury
if you are concerned that your telnet session has been sniffed, you need to also stop using FTP and switch to SFTP/FTP over SSH/SCP or something similar. SecureFX supports SFTP.

the reason being, FTP is just as insecure as telnet - it sends passwords in plaintext.

if you do not stop using FTP, you might as well use telnet, too, because you're still just as fucked.

now on to SSH. SSH is more secure, but there have been issues with various versions of it in the past. as is true with any software product, you need to make sure to monitor security lists and install necessary patches. sometimes your host can do this for you, sometimes you need to hire a sysadmin/security admin.

Thanks for the info... I guess you answered me before I asked.

For all of you who use Putty or F-Secure for their SSH protocol, what do you use for FTP?

Juge · 09-17-2002, 11:00 AM

Quote:

Originally posted by salsbury

hi Juge.

friendly advice from a random poster.

you need to either upgrade or find someone to upgrade your Apache and PHP versions. it's as likely that the intruder came in through there as it is that they came through telnet. i see ssh isn't even on the server. if your host told you that they didn't install it because of a buffer overflow bug - switch hosts. today.

I'm geting a new box with all that shit installed. The box I'm on now does not have it enabled. My host isn't making excuses, don't worry. They have been great.

Juge · 09-17-2002, 11:06 AM

Quote:

Originally posted by Hooper
ssh is perfectly secure. the exploit has been patched, but the exploit is largely misunderstood as well.

yes, it's a buffer overflow attack.. but it is one that requires the attacker to *already* be logged into an ssh client..

so they would have to already have a working user/pass in order to use the exploit.

it is largely a problem on shared systems because the attacker can get root priveleges which he/she should not have.

Thank you for the info, Hooper... we have multiple users on the box, so let's say the hacker has a user/pass of one of the users, could the hacker get su access?

Juge · 09-17-2002, 11:10 AM

Quote:

Originally posted by L0stMind
salsbury is correct... you gotta keep up to date on patching.

And just to clear some confusion here, any ssh client is fine, as long as you use ssh. Secure crt, f-secure, putty all use the same protocols... so use any of them, as long as you use ssh.

I guess the new RedHat 7.2 has a program called up2date that can be run to install the new patches at any time (sort of like windows update, huh?

), which is pretty cool... you are right, though, gotta stay with the latest updates.

payrollpete · 09-17-2002, 11:11 AM

yeah you should be using ssh instead of just normal telnet

ssh is 128bit encrpted

GFED · 09-17-2002, 11:18 AM

Quote:

Originally posted by Juge

Thanks for the info... I guess you answered me before I asked.

For all of you who use Putty or F-Secure for their SSH protocol, what do you use for FTP?

For FTP I use WS_FTP Pro.

-=HOAX=- · 09-17-2002, 11:23 AM

Quote:

Originally posted by Juge

Thank you for the info, Hooper... we have multiple users on the box, so let's say the hacker has a user/pass of one of the users, could the hacker get su access?

The best attitude to adopt is one that assumes the intruder already has root. I think its safe to say that should he have any given user/pass he could have su within a short period. and if he can cover his tracks well, it may even seem as though he is gone. Giving you a false sense of security.

KC · 09-17-2002, 11:33 AM

And POP3 is even more insecure than either telnet or ftp because of the frequency it sends your password across the net in plaintext. You can either use an SSH tunnel or find some other way to encrypt the traffic if you're going to use POP3.

-KC

Juge · 09-17-2002, 11:41 AM

Quote:

Originally posted by GFED

For FTP I use WS_FTP Pro.

I use WS_FTP LE... so, I assume the Pro version has security features?

Juge · 09-17-2002, 11:44 AM

Quote:

Originally posted by KC
And POP3 is even more insecure than either telnet or ftp because of the frequency it sends your password across the net in plaintext. You can either use an SSH tunnel or find some other way to encrypt the traffic if you're going to use POP3.

-KC

Are you fucking serious? This is unreal. I thought this was year 2002, not 1902. When are people going to learn that passwords cannot be sent as text...

Thanks again for the heads up, guys...

GFED · 09-17-2002, 11:46 AM

Quote:

Originally posted by Juge

I use WS_FTP LE... so, I assume the Pro version has security features?

None that I'm aware of... I don't think... but F-secure has a SSH File Transfer utility that is just like an FTP program (I haven't really used it much though)... I usually use Dreamweaver to update/synchronize my files coz it's simpler than loading another program... I only use WS_FTP when I have to install CGI scripts and CHMOD files...

HQ · 09-17-2002, 11:50 AM

Is WS_FTP secure?

KC · 09-17-2002, 12:02 PM

Quote:

Originally posted by HQ
Is WS_FTP secure?

No, not if you're using the FTP protocol. The protocol is where the vulnerability exists. Any application that uses that protocol to transfer files sens your username and password across the internet in plain text.

-KC

Diluted O2 · 09-17-2002, 12:10 PM

The only reason I would take up jogging is so I could hear heavy breathing again. - Erma Bombeck

KC · 09-17-2002, 12:13 PM

Quote:

Originally posted by Diluted O2
The only reason I would take up jogging is so I could hear heavy breathing again. - Erma Bombeck

Earth to Diluted02, Come in... Earth to 02, Come in..

GFED · 09-17-2002, 12:14 PM

Quote:

Originally posted by Diluted O2
The only reason I would take up jogging is so I could hear heavy breathing again. - Erma Bombeck

Ummm... have you been huffing too much pure oxygen? heheh

buran · 09-17-2002, 12:46 PM

Hey,

You want to make sure you're using ssh2, in fact. SSH1 has crypto vulnerabilities -- they're unlikely, but possible.

The goal is to make sure that no traffic to your box is using plaintext passwords. Of course, your paysite users are, but those accounts aren't important. If you implement your pop3 accounts as virtual (ie, no associated UNIX account) then you can also start treating those passwords as unimportant (worse case scenario: someone's email gets read)

Another option, setup a VPN between your office and your servers and route all traffic over it. This requires a linux box in the office, but the cost of setting one up is low and the benefits are great.

Don't forget you're just as likely to be sniffed on your local subnet as you are in the colo facility.
Perhaps more likely, if your colo has proper subnets.

As for FTP, I recommend setting up FTP over SSH2 (using SecureFX) or an SFTP client. Either method requires a special client, so you'll have to kiss WS_FTP goodbye. Is it worth it? Only if you don't want to post a GFY thread entitled "We got hacked!"

Staying secure is a matter of staying current, slashdorque will have an item for almost all the vulnerabilities you'll encounter.

Good luck, Buran

onlyreal · 09-17-2002, 01:35 PM

Use cuteftp pro

sftp and ssh is supported

s0laris2 · 09-17-2002, 01:43 PM

yes Pop3 is plain text passwords.

if you MUST run pop3 on your server use qmail if running linux. and set it up to use virtual accounts. that way NO system user ids are ever used and if a person captures the password big deal, it is only good for looking at mail :-)

GFED · 09-17-2002, 01:46 PM

Isn't it easier to use PGP than find an alternative to POP3? Any pros/cons?

KC · 09-17-2002, 01:52 PM

Quote:

Originally posted by GFED
Isn't it easier to use PGP than find an alternative to POP3? Any pros/cons?

PGP can encrypt your mail, but not your passwords... so it doesn't solve the inherent problem with POP3...

Setting up virtual accounts for email boxes... or setting up a VPN... or even an ssh tunnel (which is extremely easy to do) are probably your best bets with the mail.

SecureFX is a great tool for doing secureftp (it works just like the other GUI ftp clients) only it's secure. Your admin will need to do some setup on the backend, but it's worth it.

GFED · 09-17-2002, 01:54 PM

Quote:

Originally posted by KC

PGP can encrypt your mail, but not your passwords... so it doesn't solve the inherent problem with POP3...

Setting up virtual accounts for email boxes... or setting up a VPN... or even an ssh tunnel (which is extremely easy to do) are probably your best bets with the mail.

SecureFX is a great tool for doing secureftp (it works just like the other GUI ftp clients) only it's secure. Your admin will need to do some setup on the backend, but it's worth it.

Thanks for the quick reply KC.

TheFLY · 09-17-2002, 03:17 PM

Damn this all sux...

Juge · 09-17-2002, 04:09 PM

Quote:

Originally posted by GFED

None that I'm aware of... I don't think... but F-secure has a SSH File Transfer utility that is just like an FTP program (I haven't really used it much though)... I usually use Dreamweaver to update/synchronize my files coz it's simpler than loading another program... I only use WS_FTP when I have to install CGI scripts and CHMOD files...

Thanks for the info. I must say that WS_FTP LE sucks big time for chmod of files... it remembers the last file permission set the LAST time you set them. It DOES NOT show you the current permissions of the file you clicked on... completely unintuitive.

So, your dreamweaver is secure in uploading files?

Juge · 09-17-2002, 04:17 PM

Quote:

Originally posted by buran
Hey,

You want to make sure you're using ssh2, in fact. SSH1 has crypto vulnerabilities -- they're unlikely, but possible.

The goal is to make sure that no traffic to your box is using plaintext passwords. Of course, your paysite users are, but those accounts aren't important. If you implement your pop3 accounts as virtual (ie, no associated UNIX account) then you can also start treating those passwords as unimportant (worse case scenario: someone's email gets read)

Another option, setup a VPN between your office and your servers and route all traffic over it. This requires a linux box in the office, but the cost of setting one up is low and the benefits are great.

Don't forget you're just as likely to be sniffed on your local subnet as you are in the colo facility.
Perhaps more likely, if your colo has proper subnets.

As for FTP, I recommend setting up FTP over SSH2 (using SecureFX) or an SFTP client. Either method requires a special client, so you'll have to kiss WS_FTP goodbye. Is it worth it? Only if you don't want to post a GFY thread entitled "We got hacked!"

Staying secure is a matter of staying current, slashdorque will have an item for almost all the vulnerabilities you'll encounter.

Good luck, Buran

Buran, thank you for all of your useful information... (and people say GFY is no good for anything! bah!)... yes, this has been a wake up call for me to realize that every damn comminucation that I have been using uses plain text to send password. I feel stupid for not knowing this, but I assumed in this day and age that this would already be taken care of with any OS that was made in the past 5 years. I guess I assumed wrong.

I have no problems dumping WS FTP, I was only using the LE edition anyway, and it was bad. If anyone can confirm that the PRO version is any better, then please let me know. The makers of WS FTP sure cannot tell me the differences, so I must assume they are minimal, and thus they have given me no reason to buy it.

Juge · 09-17-2002, 04:21 PM

Quote:

Originally posted by TheFLY
Damn this all sux...

Yes it does... and I really hope this thread is not just educating me.

My damned password was being transmitted over the net 50 times a day... this was a bomb waiting to explode; it was bound to happen. You all should think about this.

HQ · 09-17-2002, 04:24 PM

Quote:

Originally posted by TheFLY
Damn this all sux...

I know, I hate being bothered by hackers.

So... to recap...

4 FTPing, use SFTP
4 TELNETing, use SSH or SSH2

anything else while it's on your mind?

playa · 09-17-2002, 05:33 PM

ok i am bout to get a headache,,
my lack of server knowledge and this thread
is scaring me

GFED · 09-17-2002, 05:48 PM

Quote:

Originally posted by Juge

Thanks for the info. I must say that WS_FTP LE sucks big time for chmod of files... it remembers the last file permission set the LAST time you set them. It DOES NOT show you the current permissions of the file you clicked on... completely unintuitive.

So, your dreamweaver is secure in uploading files?

After you CHMOD your files in WS_FTP try refreshing the directory... that works for me...

Yes, DreamweaverMX has a SSH plugin called PUTTY that is secure. I'm not sure about the ealier versions.

HQ · 09-17-2002, 06:51 PM

Quote:

Originally posted by playa
ok i am bout to get a headache,,
my lack of server knowledge and this thread
is scaring me

I already have one. Fucking hackers.

The lesson here is if you are insecure, you will eventually get hacked... it is only a matter of time.

pentae · 09-17-2002, 06:53 PM

PuTTy

spanky · 09-17-2002, 07:19 PM

Quote:

Originally posted by KC
{is WS_FTP secure?}

No, not if you're using the FTP protocol. The protocol is where the vulnerability exists. Any application that uses that protocol to transfer files sens your username and password across the internet in plain text.

-KC

The WS_FTP server can use SSL. It is probably one of the only secure ftp servers out there that isn't sftp. I think the pro version of the client is needed to work over SSL .

09-17-2002, 08:05 AM	#1
Juge Confirmed User Join Date: Feb 2001 Posts: 1,917	We got HACKED! Our server was hacked. We believe the hacker sniffed a plain text telnet session. No damage has been found. We were advised to use SSH, but heard it is exploitable through a buffer overflow. We are running Linux. What software/protocol should we use to access the server?

09-17-2002, 08:07 AM	#2
GFED Confirmed User Industry Role: Join Date: May 2002 Posts: 8,120	Get F-secure... __________________ https://www.flow.page/savethechildren

09-17-2002, 08:18 AM	#4
Hooper Confirmed User Join Date: Jul 2001 Location: A Free America Posts: 2,210	ssh is perfectly secure. the exploit has been patched, but the exploit is largely misunderstood as well. yes, it's a buffer overflow attack.. but it is one that requires the attacker to already be logged into an ssh client.. so they would have to already have a working user/pass in order to use the exploit. it is largely a problem on shared systems because the attacker can get root priveleges which he/she should not have. __________________ <a href="http://www.adultplatinum.com/"><img src="http://www.adult.com/wmbanners/10dcash-468x60.gif"></a>

09-17-2002, 09:57 AM	#11
salsbury Confirmed User Join Date: Feb 2002 Location: Seattle Posts: 1,070	if you are concerned that your telnet session has been sniffed, you need to also stop using FTP and switch to SFTP/FTP over SSH/SCP or something similar. SecureFX supports SFTP. the reason being, FTP is just as insecure as telnet - it sends passwords in plaintext. if you do not stop using FTP, you might as well use telnet, too, because you're still just as fucked. now on to SSH. SSH is more secure, but there have been issues with various versions of it in the past. as is true with any software product, you need to make sure to monitor security lists and install necessary patches. sometimes your host can do this for you, sometimes you need to hire a sysadmin/security admin. __________________

09-17-2002, 10:05 AM	#12
-=HOAX=- Confirmed User Join Date: Dec 2001 Location: CrackYaMental Posts: 4,365	I use ssh2 __________________ Insert Value Here.

09-17-2002, 08:45 AM	#7
Dusen Confirmed User Join Date: Aug 2002 Location: East Coast. Posts: 2,251	I acutally prefer putty. I have used SecureCRT, and a few others and I find that putty suits my needs fine, and it's FREE. I vote use putty.

09-17-2002, 08:47 AM	#8
Dusen Confirmed User Join Date: Aug 2002 Location: East Coast. Posts: 2,251	And ANY ssh client is preferable to Telnet. No matter your reservations about the exploit, remember you were just sending plain text commands to your server. I don't even have telnet enabled on my boxes. Jake

09-17-2002, 09:10 AM	#9
High Quality Confirmed User Join Date: Feb 2002 Location: Vegas Posts: 5,741	SSH is the only thing to use.

09-17-2002, 09:48 AM	#10
Wilbo Confirmed User Join Date: Mar 2001 Location: Baltimore Posts: 2,082	Make sure you disable telnet also, don't just stop using it.

09-17-2002, 10:09 AM	#13
L0stMind Confirmed User Join Date: Sep 2002 Location: Vancity Posts: 1,681	salsbury is correct... you gotta keep up to date on patching. And just to clear some confusion here, any ssh client is fine, as long as you use ssh. Secure crt, f-secure, putty all use the same protocols... so use any of them, as long as you use ssh.

09-17-2002, 10:52 AM	#15
crack Confirmed User Join Date: Feb 2002 Posts: 100	Article: http://www.wired.com/news/linux/0,1411,55172,00.html Source: http://crack.sh/hack/Slapper%20Worm.htm __________________ There is a crack in everything. That's how the light gets in.

09-17-2002, 10:59 AM	#18
GFED Confirmed User Industry Role: Join Date: May 2002 Posts: 8,120	Not sure about the SCP file transfer... but F-secure also has a SSH file transfer utility that is pretty sweet... __________________ https://www.flow.page/savethechildren

09-17-2002, 11:11 AM	#23
payrollpete Confirmed User Join Date: Feb 2002 Location: Seattle, WA Posts: 1,527	yeah you should be using ssh instead of just normal telnet ssh is 128bit encrpted __________________ <a href="http://www.techiemedia.com"><img src="http://banners.techiemedia.net/techie120.gif">

09-17-2002, 11:33 AM	#26
KC Confirmed User Industry Role: Join Date: Jan 1995 Posts: 2,417	And POP3 is even more insecure than either telnet or ftp because of the frequency it sends your password across the net in plaintext. You can either use an SSH tunnel or find some other way to encrypt the traffic if you're going to use POP3. -KC

09-17-2002, 11:50 AM	#30
HQ Confirmed User Join Date: Jan 2001 Posts: 3,539	Is WS_FTP secure?

09-17-2002, 12:10 PM	#32
Diluted O2 Registered User Join Date: Sep 2002 Location: A-town baby, Good ole PA Posts: 56	The only reason I would take up jogging is so I could hear heavy breathing again. - Erma Bombeck __________________ <CENTER><a href="http://www.matrixbucks.com/?aid=453817"><IMG src="http://www.mindgoo.com/stoob/banner103.gif"></a></CENTER>

09-17-2002, 12:46 PM	#35
buran Confirmed User Join Date: Mar 2002 Location: how'd I get here? Posts: 264	Hey, You want to make sure you're using ssh2, in fact. SSH1 has crypto vulnerabilities -- they're unlikely, but possible. The goal is to make sure that no traffic to your box is using plaintext passwords. Of course, your paysite users are, but those accounts aren't important. If you implement your pop3 accounts as virtual (ie, no associated UNIX account) then you can also start treating those passwords as unimportant (worse case scenario: someone's email gets read) Another option, setup a VPN between your office and your servers and route all traffic over it. This requires a linux box in the office, but the cost of setting one up is low and the benefits are great. Don't forget you're just as likely to be sniffed on your local subnet as you are in the colo facility. Perhaps more likely, if your colo has proper subnets. As for FTP, I recommend setting up FTP over SSH2 (using SecureFX) or an SFTP client. Either method requires a special client, so you'll have to kiss WS_FTP goodbye. Is it worth it? Only if you don't want to post a GFY thread entitled "We got hacked!" Staying secure is a matter of staying current, slashdorque will have an item for almost all the vulnerabilities you'll encounter. Good luck, Buran __________________ [this signature intentionally left blank]

09-17-2002, 01:35 PM	#36
onlyreal Confirmed User Join Date: Jun 2001 Posts: 853	Use cuteftp pro sftp and ssh is supported

09-17-2002, 01:43 PM	#37
s0laris2 Confirmed User Join Date: Jun 2002 Posts: 317	yes Pop3 is plain text passwords. if you MUST run pop3 on your server use qmail if running linux. and set it up to use virtual accounts. that way NO system user ids are ever used and if a person captures the password big deal, it is only good for looking at mail :-) __________________

09-17-2002, 01:46 PM	#38
GFED Confirmed User Industry Role: Join Date: May 2002 Posts: 8,120	Isn't it easier to use PGP than find an alternative to POP3? Any pros/cons? __________________ https://www.flow.page/savethechildren

09-17-2002, 03:17 PM	#41
TheFLY So Fucking Banned Join Date: Jan 2001 Location: http://www.thefly.net/ --- Quit your job and live off steady traffic. Posts: 11,856	Damn this all sux...

09-17-2002, 05:33 PM	#46
playa Confirmed User Join Date: Feb 2001 Location: atlanta, GA Posts: 6,432	ok i am bout to get a headache,, my lack of server knowledge and this thread is scaring me

09-17-2002, 06:53 PM	#49
pentae Confirmed User Industry Role: Join Date: Jul 2002 Location: Inconceivable! Posts: 899	PuTTy