RE: Re: [OT] - HELP PLEASE we've been hacked.

["Dean Barrett" <dean@xxxxxxxxxxxxxxxx>]

Thanks for that Chris.

At least you've stopped ROFLOL ;)

Once machine is formatted and reconfigured maybe I'll asked you to check it
out for me.



Dean.


-----Original Message-----
From: Chris Bond [mailto:chris@xxxxxxx]
Sent: 13 April 2004 19:32
To: ukha_d@xxxxxxx
Subject: [ukha_d] Re: [OT] - HELP PLEASE we've been hacked.

> I would be grateful for someone to explain HOW they did it ?

Thats the easy bit it would have either been a subnet scan that
checked for known exploits.  ie. remote buffer overflow that your not
patched for then automatically launch the attack.

I'll be pritty sure thats how they got on your system, the other
thing would have been weak passwords and a dictonary based attack on
RDC, mssql etc.  The other way they could have got in is a new buffer
overflow that there clever enuff to write themself.

They posted there nfo on there ftp login, quite a common technique of
warez hackers, they was only interested in running a ftp site to
propagate warez.

Your attackers almost certainly was from brazil, singapore or a
country like that as thats where most of them come from, 99% of
attacks ive seen have orignated from there abouts.






UK Home Automation Meet 2004 - BOOK NOW!
http://www.ukha2004.com

http://www.automatedhome.co.uk

Member Offers - http://www.freeranger.co.uk/ukha