Re: Have I been hacked?
Hello,
yeah, but they don't mean anything... i think they are just markers to say "yes
- the daemon is still running".
what is the first thing before all of those --MARK--'s, and when is it?
Richard.
Quoting Ian Goodall <ijg@iangoodall.co.uk>:
> just lots of
>
> May 7 06:03:06 dev1 -- MARK --
>
> ----- Original Message -----
> From: "Hobbs, Richard" <hobbs@mongeese.co.uk>
> To: "Ian Goodall" <ijg@iangoodall.co.uk>
> Cc: <debian-security@lists.debian.org>
> Sent: Wednesday, May 07, 2003 3:27 PM
> Subject: Re: Have I been hacked?
>
>
> > Hello,
> >
> > Check /var/log/messages to see if anything happened before 14:49 on 7
> May... are
> > you running "logcheck"?? It emails you daily reports of important goings
> on...
> > like user's crontab changes, logins, su's and other important things. it's
> very
> > very useful for spotting non-normal operations like ls.
> >
> > HTH...
> >
> > Richard.
> >
> >
> > Quoting Ian Goodall <ijg@iangoodall.co.uk>:
> >
> > > I am running a debian woody server and when I checked the last users
> > > yesterday I a large number of logins in the list. On running the command
> > > today I get the following:
> > >
> > > dev1:/home/ian# last
> > > ian pts/0 172.16.3.195 Wed May 7 14:49 still logged
> in
> > > team1 pts/0 blue99.ex.ac.uk Wed May 7 13:21 - 13:57 (00:35)
> > >
> > > I have run chkrootkit but nothing was found.
> > >
> > > I have never had this before. Am I being paranoid or is someone trying
> to
> > > cover up their tracks?
> > >
> > > Thanks
> > >
> > > ijg0
> > >
> > >
> > >
> > > --
> > > To UNSUBSCRIBE, email to debian-security-request@lists.debian.org
> > > with a subject of "unsubscribe". Trouble? Contact
> > > listmaster@lists.debian.org
> > >
> > >
> >
> >
> > --
> > Richard Hobbs
> > hobbs@mongeese.co.uk
> > http://mongeese.co.uk | http://unixforum.co.uk
> >
> > "There's only one way of life, and that's your own" - The Levellers
> >
> > _____________________________________________________
> > Send all your jokes to jokes@fishsponge.co.uk !!
> > To subscribe, email: jokes-subscribe@fishsponge.co.uk
>
>
> --
> To UNSUBSCRIBE, email to debian-security-request@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact
> listmaster@lists.debian.org
>
>
--
Richard Hobbs
hobbs@mongeese.co.uk
http://mongeese.co.uk | http://unixforum.co.uk
"There's only one way of life, and that's your own" - The Levellers
_____________________________________________________
Send all your jokes to jokes@fishsponge.co.uk !!
To subscribe, email: jokes-subscribe@fishsponge.co.uk
Reply to: