Tag Info

New answers tagged

2

As freddyb said, this seems to be a scam. I looked at the "removal tool" for the virus - it contains an executable that forks off into the background, renames itself to udevd, connects to 95.215.44.195:443 (that server seems to be down atm), sends the string FOG\n\n# and gives the server a reverse shell (by dup()ing the socket to fds 0,1,2, then executing ...


4

This virus alert is a scam. The goal is to get admins to download and execute special "removal tools", which are in fact the actual virus. Another note about how websites work and what you see in the access log: You can go to basically every website and append arbitrary parameters like ?cmd=foo&key=bar and the website will just load and ignore the ...


0

This IP address is showing at present via i2p in the TOR browser. Somebody is using an anonymous network to get some sort of information from your server, and probably also has code there to send other commands to it.


1

It looks like that's trying to communicate with a previously-installed program. I'd guess (from cmd=info) that it's trying to see if install was completed. ip=1.2.3.4 (which I assume is your IP anonymized) is telling it what IP it is trying to talk to, in case the traffic would come back from another IP. It's probably nothing, just a scanner for some bit ...


5

This is an known attack, Shellshock. On servers with a vulnerable bash shell, the attacker can exploit an condition that executes shell commands by sending a special crafted URL. Basically, the attacker is scanning your server to see if it is vulnerable to it. If your server was found to be vulnerable, probably you would see a few wget/curl being sent in ...


1

Another possible solution could be to forward the auditd logs to the standard syslog logger. To do so you can configure the audispd syslog plugin. In a debian machine should be under /etc/audispd/plugins.d/syslog root@debian:/etc# cat /etc/audisp/plugins.d/syslog.conf # This file controls the configuration of the # syslog plugin. It simply takes events ...


1

What are the threats posed by this situation? Threats include information leakage as this info could be in your logs in plaintext: Passwords for other sites or systems. Partially entered passwords for your system. Old, similar passwords. Old passwords that were attempted since password was changed, which may have been reused elsewhere. Passwords with ...


4

The threats is that if anybody of the team members is crooked he/she could guess the correct password. Invalid login attempts - it seems to me - are because of 3 reasons: spelling mistakes for password or user name wrong password or username invalid attempts (hitting enter too early, no password at all etc) Now for the spelling mistake it is very ...


0

Most companies provide internet access through proxy server(s). If you can determine their proxy server IP addresses you can simply block their access. Alternatively many companies have a block of IP addresses assigned to them, you might be able to determine these from whois lookups, then you can block their whole network segment.


0

If you know a few accesses done by such employees from their company, you can easily map the ips used to a range with a whois lookup (it may even be a single ip if they go out through a proxy). If they have several sites they may exit from a few ranges.


1

There are certain companies that provide such information. An easy way is to go to the following url and put the company name you want to get the adresses for into the search box: http://bgp.he.net/ You will be presented with a list of ip addresses connected to the specified company if there are any. The link leads to the "BGP Toolkit" of Hurricane ...



Top 50 recent answers are included