Re: Have I been hacked?

[Fred Herman <fherman inferential com>]

You have been hacked.  See:

http://www.cert.org/current/current_activity.html#bind

You need to disconnect your box.  Unless you're expert, reformat the
hard drive and re-install.  Make sure your patches are up to date.  This
exploit is fixed by updating the bind rpm's.  See:

http://www.redhat.com/support/errata/rh61-errata-security.html

Fred


Ed Lazor wrote:
> 
> I suspect that I've been hacked.  I found a directory titled "ADMROCKS" in
> /var/named owned by root and I know that I didn't create it.  Does anyone
> recognize this?
> 
> Any recommendations / advice on how to move forward?  I have RedHat 6.1 and
> all of the latest updates on the system.  My guess is that I'll need to
> rebuild the system.  Of course, there's no way for me to know if the hacker
> can just break right back in after I do that.  I also figure I need to setup
> a firewall.  Any recommendations on that?  Ie. firewall software to use,
> related URLs, etc.
> 
> Thanks =)
> 
> -Ed
> 
> --
> To unsubscribe: mail redhat-list-request redhat com with "unsubscribe"
> as the Subject.