Looks like my linode was hacked in February
I immediately noticed that my iptables shell script had a modify date of Feb 21, 2007. This seemed odd, I didn't remember editing that for a few years. Hmmm. Looking into my script, now there were additionally ports 110, 143 and 995 unblocked, and the following line at the bottom of the script:
iptables -I INPUT -s 194.72.238.62 -j DROP
which traceroute points to the UK.
How they got in I don't know. I've corrected the script and changed all passwords. You might want to check your iptables start scripts.
James
5 Replies
As far as how they got in, 194.72.238.62 is known for trying to break in through Apache vulnerabilities.
@jax:
Better to format and restore files from backups than it is to just patch a firewall hole.
In progress.
James
A quick lookup on the host that was blocked indicates its one of netcraft's servers- they gather statistics on active web servers, and probably also check for vulnerabilities for their own mostly benign purposes…
If that IP did hack you, it wouldn't be very logical to then block themselves out of your machine, would it? This sounds more like a case of late night drunken configuration changes, or just doing things in the wrong terminal window…
But of course, if you're in any doubt as to the security of your system, a rebuild is always the best way to go…
And it makes no sense that a cracker would add a drop rule to iptables.
network usage, so I don't know that it was put to use.
My guess on the block was so that the script kiddie next
door couldn't use it post-brag.
James