Fedora Linux Support Community & Resources Center

Home Forums Posting Rules Linux Help Fedora Set-Up Guides Ask Fedora Fedora Project
Go Back   FedoraForum.org > Fedora 17/18 > Security and Privacy
Reload this Page Fedora 7 Compromised by ISP
FedoraForum Search
Forgot Password? Join Us!
Register All Albums FAQ Search Today's Posts Mark Forums Read

Security and Privacy Sadly, malware, spyware, hackers and privacy threats abound in today's world. Let's be paranoid and secure our penguins, and slam the doors on privacy exploits.

Reply
Page 1 of 4 1 23 Last »
 
Thread Tools Search this Thread Display Modes
  #1  
Old 26th July 2007, 10:00 AM
Peter_APIIT Offline
Registered User
  
Join Date: Dec 2006
Location: Malaysia
Age: 27
Posts: 260
Thumbs up Fedora 7 Compromised by ISP
Hello all expert Linux Security administrator,

Hello all, latest news from Peter_APIIT.

My system has been compromised. How i know the system is been compromised.

The iptables firewall rules has changed. My etc/sysconfig/iptables-config has been deleted.

Moreover, my state share object(State library) also been deleted.

How i can block my ISP hacked during netowrk initialization because i realised my ISP always hacked during the initialization of the connection.

I just don't understand how he can remove the files and gain root access to my pc.

I have afick, Bastille, File Integrity checker and AIDE installed.


I think i should beg for any helps.

Please help me. No internet no life.


I think fedora core is not as secure as others distributions.


This is my rules before compromised.

Chain INPUT (policy DROP)
target prot opt source destination
fail2ban-SSH tcp -- anywhere anywhere tcp dpt:ssh
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,ACK/RST
DROP 0 -- anywhere anywhere state NEW ctstate NEW
DROP 0 -- anywhere anywhere state NEW
DROP 0 -f anywhere anywhere
DROP 0 -- anywhere anywhere ctstate INVALID
ACCEPT 0 -- anywhere anywhere ctstate RELATED,ESTABLISHED state RELATED,ESTABLISHED
ACCEPT 0 -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT udp -- anywhere anywhere state ESTABLISHED
ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp spt:ftp state ESTABLISHED
REJECT tcp -- anywhere anywhere reject-with tcp-reset
REJECT udp -- anywhere anywhere reject-with icmp-port-unreachable
ACCEPT icmp -- anywhere anywhere icmp echo-reply
DROP icmp -- anywhere anywhere
RH-Firewall-1-INPUT 0 -- anywhere anywhere
DROP tcp -- anywhere anywhere tcp dpt:31337
DROP tcp -- anywhere anywhere tcp dpt:telnet
DROP 0 -- anywhere anywhere ctstate INVALID
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh recent: SET name: SSH side: source
DROP tcp -- anywhere anywhere tcp dpt:ssh recent: UPDATE seconds: 180 hit_count: 2 name: SSH side: source

Chain FORWARD (policy ACCEPT)
target prot opt source destination
REJECT 0 -- anywhere anywhere reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT 0 -- anywhere anywhere ctstate NEW,RELATED,ESTABLISHED state NEW,RELATED,ESTABLISHED
ACCEPT 0 -- anywhere anywhere state NEW,RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere state NEW,RELATED,ESTABLISHED
ACCEPT udp -- anywhere anywhere state NEW,RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere state NEW,RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp dpt:ftp state NEW,ESTABLISHED
ACCEPT icmp -- anywhere anywhere icmp echo-request

Chain RH-Firewall-1-INPUT (1 references)
target prot opt source destination
ACCEPT icmp -- anywhere anywhere icmp any
ACCEPT esp -- anywhere anywhere
ACCEPT ah -- anywhere anywhere
ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns
ACCEPT udp -- anywhere anywhere udp dpt:ipp
ACCEPT tcp -- anywhere anywhere tcp dpt:ipp
ACCEPT 0 -- anywhere anywhere state RELATED,ESTABLISHED
REJECT 0 -- anywhere anywhere reject-with icmp-host-prohibited

Chain fail2ban-SSH (1 references)
target prot opt source destination
RETURN 0 -- anywhere anywhere

I cannot put into Quote.

I don't know why.

Thanks for your helps.
__________________
Linux is the best OS in the world.
Reply With Quote
  #2  
Old 26th July 2007, 10:03 AM
Peter_APIIT Offline
Registered User
  
Join Date: Dec 2006
Location: Malaysia
Age: 27
Posts: 260
How can i do a system restore in Linux where this function appear in Windows but Linux is far more better ?

How about this toolkit ?
Trinity Rescue Kit

I lazy to reinstall it. A billion thanks to you all.
__________________
Linux is the best OS in the world.
Reply With Quote
  #3  
Old 26th July 2007, 10:09 AM
a_small_cake's Avatar
a_small_cake Offline
Registered User
  
Join Date: Jun 2007
Location: Poland
Posts: 248
Honestly if you suspect your ISP you should notify Police about it. If your ISP is hacking your PC this is a crime.
Reply With Quote
  #4  
Old 26th July 2007, 11:49 AM
ibbo's Avatar
ibbo Offline
Registered User
  
Join Date: Jun 2005
Location: Leeds
Posts: 1,264
I do not know whats going on with your machines security but

"Please help me. No internet no life." prmots me to tell you to get out more. Much more!

Hope you resolve your problem though.

Ibbo
__________________
A Hangover Lasts A Day, But Our Drunken Memories Last A Lifetime
--
Linux user #349545
(GNU/Linux)iD8DBQBAzWjX+MZAIjBWXGURAmflAKCntuBbuKCWenpm XoA7LNydllVQOwCfdjyzXscddzQvlhBedAcD7qfKmHo==zx0H
Reply With Quote
  #5  
Old 26th July 2007, 12:21 PM
PilotJLR's Avatar
PilotJLR Offline
Registered User
  
Join Date: Nov 2005
Location: flying a cubicle
Posts: 465
The lack of your iptables chains does not, by itself, automatically mean you are hacked... unless you have other evidence.

Do you have an /etc/sysconfig/iptables file? If so, what is its contents?
Also, what output do you get if you do a : service iptables restart?

Lastly... just to cover all bases... when you setup these rules before, did you ever run a "service iptables save" to make them persistent?
Reply With Quote
  #6  
Old 26th July 2007, 12:42 PM
leigh123linux's Avatar
leigh123linux Offline
Retired Administrator
  
Join Date: Oct 2006
Posts: 21,509
Quote:
Originally Posted by Peter_APIIT
Hello all expert Linux Security administrator,

Hello all, latest news from Peter_APIIT.

My system has been compromised. How i know the system is been compromised.

The iptables firewall rules has changed. My etc/sysconfig/iptables-config has been deleted.

Moreover, my state share object(State library) also been deleted.

How i can block my ISP hacked during netowrk initialization because i realised my ISP always hacked during the initialization of the connection.

I just don't understand how he can remove the files and gain root access to my pc.

I have afick, Bastille, File Integrity checker and AIDE installed.


I think i should beg for any helps.

Please help me. No internet no life.


I think fedora core is not as secure as others distributions.


This is my rules before compromised.

Chain INPUT (policy DROP)
target prot opt source destination
fail2ban-SSH tcp -- anywhere anywhere tcp dpt:ssh
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,ACK/RST
DROP 0 -- anywhere anywhere state NEW ctstate NEW
DROP 0 -- anywhere anywhere state NEW
DROP 0 -f anywhere anywhere
DROP 0 -- anywhere anywhere ctstate INVALID
ACCEPT 0 -- anywhere anywhere ctstate RELATED,ESTABLISHED state RELATED,ESTABLISHED
ACCEPT 0 -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT udp -- anywhere anywhere state ESTABLISHED
ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp spt:ftp state ESTABLISHED
REJECT tcp -- anywhere anywhere reject-with tcp-reset
REJECT udp -- anywhere anywhere reject-with icmp-port-unreachable
ACCEPT icmp -- anywhere anywhere icmp echo-reply
DROP icmp -- anywhere anywhere
RH-Firewall-1-INPUT 0 -- anywhere anywhere
DROP tcp -- anywhere anywhere tcp dpt:31337
DROP tcp -- anywhere anywhere tcp dpt:telnet
DROP 0 -- anywhere anywhere ctstate INVALID
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh recent: SET name: SSH side: source
DROP tcp -- anywhere anywhere tcp dpt:ssh recent: UPDATE seconds: 180 hit_count: 2 name: SSH side: source

Chain FORWARD (policy ACCEPT)
target prot opt source destination
REJECT 0 -- anywhere anywhere reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT 0 -- anywhere anywhere ctstate NEW,RELATED,ESTABLISHED state NEW,RELATED,ESTABLISHED
ACCEPT 0 -- anywhere anywhere state NEW,RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere state NEW,RELATED,ESTABLISHED
ACCEPT udp -- anywhere anywhere state NEW,RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere state NEW,RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp dpt:ftp state NEW,ESTABLISHED
ACCEPT icmp -- anywhere anywhere icmp echo-request

Chain RH-Firewall-1-INPUT (1 references)
target prot opt source destination
ACCEPT icmp -- anywhere anywhere icmp any
ACCEPT esp -- anywhere anywhere
ACCEPT ah -- anywhere anywhere
ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns
ACCEPT udp -- anywhere anywhere udp dpt:ipp
ACCEPT tcp -- anywhere anywhere tcp dpt:ipp
ACCEPT 0 -- anywhere anywhere state RELATED,ESTABLISHED
REJECT 0 -- anywhere anywhere reject-with icmp-host-prohibited

Chain fail2ban-SSH (1 references)
target prot opt source destination
RETURN 0 -- anywhere anywhere

I cannot put into Quote.

I don't know why.

Thanks for your helps.
Where is your evidence to back up you claim that you have been hacked ?
__________________
My Hardware
- CPU: AMD Phenom II X6 Hex Core 1055T 95W Edition @3.5Ghz
- Motherboard: Gigabyte GA-880GM-UD2H
- Cooler: Corsair H50 CPU Cooler
- RAM: Corsair Dominator 8GB (4x2GB) DDR3 1600MHz
- Graphics: Gigabyte GeForce GTS 450 OC 1024MB GDDR5
Reply With Quote
  #7  
Old 27th July 2007, 03:47 AM
Peter_APIIT Offline
Registered User
  
Join Date: Dec 2006
Location: Malaysia
Age: 27
Posts: 260
The iptables firewall rules has changed. My etc/sysconfig/iptables-config has been deleted.

Moreover, my state share object(State library) also been deleted.

I have the /etc/sysconfig/iptbales before i been compromised but after been compromised, the file is no longer exists.
__________________
Linux is the best OS in the world.
Reply With Quote
  #8  
Old 27th July 2007, 03:48 AM
Peter_APIIT Offline
Registered User
  
Join Date: Dec 2006
Location: Malaysia
Age: 27
Posts: 260
Thumbs up
When i run service iptables restart, the out is as follow.

/etc/sysconfig/iptables-config: line 23: Save: command not found
Flushing firewall rules: [ OK ]
Setting chains to policy ACCEPT: filter [ OK ]
Unloading iptables modules: [ OK ]
Applying iptables firewall rules: [ OK ]
Loading additional iptables modules: ip_conntrack_netbios_ns [ OK ]
__________________
Linux is the best OS in the world.
Reply With Quote
  #9  
Old 27th July 2007, 03:54 AM
Peter_APIIT Offline
Registered User
  
Join Date: Dec 2006
Location: Malaysia
Age: 27
Posts: 260
How my ISP can gain the root access ? This is pretty somehting like magic.

I ope you all can help me out.
__________________
Linux is the best OS in the world.
Reply With Quote
  #10  
Old 27th July 2007, 04:13 AM
leigh123linux's Avatar
leigh123linux Offline
Retired Administrator
  
Join Date: Oct 2006
Posts: 21,509
Quote:
Originally Posted by Peter_APIIT
When i run service iptables restart, the out is as follow.

/etc/sysconfig/iptables-config: line 23: Save: command not found
Flushing firewall rules: [ OK ]
Setting chains to policy ACCEPT: filter [ OK ]
Unloading iptables modules: [ OK ]
Applying iptables firewall rules: [ OK ]
Loading additional iptables modules: ip_conntrack_netbios_ns [ OK ]
you haven't made the rules persistent and you flush the changes when you reboot

Quote:
Originally Posted by PilotJLR
when you setup these rules before, did you ever run a "service iptables save" to make them persistent?
su -
service iptables save
__________________
My Hardware
- CPU: AMD Phenom II X6 Hex Core 1055T 95W Edition @3.5Ghz
- Motherboard: Gigabyte GA-880GM-UD2H
- Cooler: Corsair H50 CPU Cooler
- RAM: Corsair Dominator 8GB (4x2GB) DDR3 1600MHz
- Graphics: Gigabyte GeForce GTS 450 OC 1024MB GDDR5
Reply With Quote
  #11  
Old 27th July 2007, 04:15 AM
leigh123linux's Avatar
leigh123linux Offline
Retired Administrator
  
Join Date: Oct 2006
Posts: 21,509
Quote:
Originally Posted by Peter_APIIT
How my ISP can gain the root access ? This is pretty somehting like magic.

I ope you all can help me out.

You are not hacked , it's just your inability to use iptables properly
__________________
My Hardware
- CPU: AMD Phenom II X6 Hex Core 1055T 95W Edition @3.5Ghz
- Motherboard: Gigabyte GA-880GM-UD2H
- Cooler: Corsair H50 CPU Cooler
- RAM: Corsair Dominator 8GB (4x2GB) DDR3 1600MHz
- Graphics: Gigabyte GeForce GTS 450 OC 1024MB GDDR5
Reply With Quote
  #12  
Old 28th July 2007, 08:48 AM
Peter_APIIT Offline
Registered User
  
Join Date: Dec 2006
Location: Malaysia
Age: 27
Posts: 260
I 100% sure that i save that rules before i flush it.

I always checked after reboot.

Any idea how to solve this problem ?

A billion thanks to you all.
__________________
Linux is the best OS in the world.
Reply With Quote
  #13  
Old 28th July 2007, 09:11 PM
marcrblevins's Avatar
marcrblevins Offline
Registered User
  
Join Date: Jun 2006
Location: Texas
Age: 42
Posts: 4,168
Change your iptables correctly.
Code:
su -
vi /etc/sysconfig/iptables
service iptables save
Code:
su -
service iptables restart
iptables --list
Does the list show the correct listing?
Reply With Quote
  #14  
Old 29th July 2007, 03:27 AM
larryc06 Offline
Registered User
  
Join Date: Mar 2007
Posts: 72
I have had it happen to me and I had the evidence. A tech friend of mine was over so he secured the evidence and put it and the program he used on a memory stick. It does happen with some bored ISP workers. If this is what is happening to you have to have more than what you said to teach this person not to play in your playground. On another note I noticed you said that you checked your iptables before you flushed them and all was ok. Think about that. You need to check them after the flush and reinstatement, not before. Good luck
Reply With Quote
  #15  
Old 29th July 2007, 04:31 AM
Peter_APIIT Offline
Registered User
  
Join Date: Dec 2006
Location: Malaysia
Age: 27
Posts: 260
Thumbs up
Thanks for your help.
__________________
Linux is the best OS in the world.
Reply With Quote
Reply
Page 1 of 4 1 23 Last »

Tags
compromised, fedora, isp

« Previous Thread | Next Thread »
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes
Linear Mode Linear Mode

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
My Server Appears compromised joetesting311 Security and Privacy 5 11th April 2007 12:21 AM
system compromised? 84NITRAM Using Fedora 2 24th December 2006 02:14 AM
need urgent help - fedora 3. server got compromised asprin_nyc Security and Privacy 7 15th November 2006 02:01 AM


Current GMT-time: 11:12 (Saturday, 18-05-2013)

TopSubscribe to XML RSS for all Threads in all ForumsFedoraForumDotOrg Archive
logo

All trademarks, and forum posts in this site are property of their respective owner(s).
FedoraForum.org is privately owned and is not directly sponsored by the Fedora Project or Red Hat, Inc.
Privacy Policy | Term of Use | Posting Guidelines | Archive | Contact Us | Founding Members

Powered by vBulletin® Copyright ©2000 - 2012, vBulletin Solutions, Inc.

 FedoraForum is Powered by RedHat