Got hacked yesterday
 

TGIF, so I thought. It's Friday afternoon, I'm about to take a nap and hit the strip clubs later. Well, it was not to be.

I got a call from my monitoring service saying that connection was refused to my sites. There was no remote or console access to the server. I had to boot from the CD and reinstall the binaries. Checking my system logs, it appears that someone took advantage of an exploit in my FTP server and installed a root kit along with a sniffer. Based on the time stamps, they had 2 hours of access to the server.

It took me 9 hours to restore the system check for additional vulnerabilities and make the necessary patches. What a bitch!

not my problem

What FTP server? Wuftpd ?

Out of curiosity what OS was the server running?

yah, There are some new sshd, and sendmail vulnerabilities out too that everyone should get patched up.

proFTPD

http://www.securityfocus.com/archive/1/338687

I had to patch sendmail as well

Red Hat Linux 8

ya their was an exploit out for proftpd i upgraded mine, i use proftpd as well, i ditched sendmail on all our servers. i use qmail. secure as a mofo. but then again we dont use linux. freebsd all the way.


make sure to upgrade your openssh too. exploit came out for that too recently.