Welcome to WebmasterWorld Guest from 54.145.209.34

Forum Moderators: bakedjake

DDOS hacked my server to attack other server

   
1:40 pm on Sep 19, 2005 (gmt 0)

10+ Year Member



Dear All,

I'm server owner. I have received the complain email from my data center. They said that my server attack other server(DDOS).
Maybe someone hack my server to install software to control my server.How can I check it?

BR
Kitty

6:16 pm on Sep 19, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Can you log into your server? If so, it hasn't been completely taken over. You may be in a heap of trouble anyway, though. Once someone has compromised your machine, the only reliable fix is to wipe it out and start over. Back up all of your content files first!

What type of server are you running?

10:03 pm on Sep 19, 2005 (gmt 0)

10+ Year Member



Well easiest way to check what was your server was doing is by checking "/var/log/messages" and definetely "netstat"

"finger" to see if anyone's on the the server, use "w" ("top" is even better) to check all their processes. Also use "ps xu" to see all existing processes on the server. So basically this is all you need.

4:52 pm on Sep 20, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



If indeed it's a 'Nix box. There are similar tools available for MS boxes.

Keep in mind, too, that most rootkits (if one is installed) will mess with the

top
and
ps
output, along with removing info from
wtmp
and cleaning out traces from the normal log files, like
/var/log/messages
.

If your system has been compromised and taken over completely, you won't be able to do anything but reboot, if that. If it's being used to mount attacks without having been completely taken over, you can probably see the activity by using

top
or
ps aux
, but you may be too late to stop it without reinstalling the OS ... you simply cannot tell which system files have been replaced with bogus ones unless you already had in place some mechanism for doing so. If they're compromised now, you won't be able to tell. File timestamps, permissions, all of that can be forged or appropriated.

We really need more details about your server before we can offer any specific advice, like what operating system and version it's running.

 

Featured Threads

Hot Threads This Week

Hot Threads This Month