[volunteergrid2-l] I'm sorry, but Introducer furl leaked
Johannes Nix
Johannes.Nix at gmx.net
Wed Mar 7 18:32:25 UTC 2012
Hi Marcus,
what would be good to know is whether you were running any other
network-related thing besides Tahoe on the server?
Hope you can recover that quickly,
Johannes
On Wed, 7 Mar 2012 14:34:13 +0100
sabotrax at gmail.com wrote:
> hi,
> i sent this mail to the ml yesterday, but i didn't come through, so i
> resend it as a reply:
>
> Hi all,
> it seems as if my server who is running tahoe has been hacked.
> i hate to say this, but i think the introducer furl has to be changed
> again.
>
> i just looked around my system when i saw a new dir "test" under
> "/home" that has been created on 2012/02/21.
> i then did:
>
> root at foo:/home# lsof |grep test
> bash 1458 test cwd DIR 0,18 460
> 6108855 /run/shm/ / /bot
> bash 1458 test rtd DIR 8,1 4096
> 2 /
> bash 1458 test txt REG 0,18 492135
> 6108126 /run/shm/ / /bot/bash
> bash 1458 test mem REG 8,1 79712
> 14811193 /lib32/libresolv-2.13.so
> bash 1458 test mem REG 8,1 46736
> 14811192 /lib32/libnss_files-2.13.so
> bash 1458 test mem REG 8,1 1532104
> 14811189 /lib32/libc-2.13.so
> bash 1458 test mem REG 8,1 22092
> 14811194 /lib32/libnss_dns-2.13.so
> bash 1458 test mem REG 8,1 126152
> 14811196 /lib32/ld-2.13.so
> bash 1458 test 0w REG 0,18 2153806
> 6108891 /run/shm/ / /bot/LinkEvents
> bash 1458 test 1u sock 0,7 0t0
> 85480587 can't identify protocol
> bash 1458 test 2u sock 0,7 0t0
> 85479769 can't identify protocol
> bash 1458 test 3u IPv4 6108142 0t0
> UDP *:49486
> bash 1458 test 4u sock 0,7 0t0
> 85481277 can't identify protocol
> bash 1458 test 5u sock 0,7 0t0
> 85698092 can't identify protocol
> bash 1458 test 6u sock 0,7 0t0
> 85498612 can't identify protocol
> bash 1458 test 7u sock 0,7 0t0
> 85576571 can't identify protocol
> bash 1458 test 8u sock 0,7 0t0
> 86667704 can't identify protocol
> bash 1458 test 9u sock 0,7 0t0
> 86667741 can't identify protocol
> bash 1458 test 10u sock 0,7 0t0
> 86669526 can't identify protocol
> bash 1458 test 11u sock 0,7 0t0
> 86669303 can't identify protocol
> bash 1458 test 12u sock 0,7 0t0
> 86671788 can't identify protocol
> bash 1458 test 13u sock 0,7 0t0
> 86670345 can't identify protocol
> bash 1458 test 14u IPv4 89167118 0t0
> TCP foo.cyberdeck.null:38455->161.53.178.240:ircd
> (SYN_SENT)
> bash 1458 test 15u sock 0,7 0t0
> 86671794 can't identify protocol
> bash 1458 test 16u sock 0,7 0t0
> 86707925 can't identify protocol
> bash 1458 test 17u sock 0,7 0t0
> 87574595 can't identify protocol
> bash 1458 test 18u IPv4 89167113 0t0
> TCP
> foo.cyberdeck.null:49523->173.245.201.28:afs3-fileserver (SYN_SENT)
> root at foo:/home# halt
> W: molly-guard: SSH session detected!
> Please type in hostname of the machine to halt: foo
>
> An alle Benutzer verteilte Nachricht von undo at foo
> (/dev/pts/0) um 16:24 ...
>
> Das System wird sich JETZT zum Anhalten herunterfahren!
>
> ---
>
> looks like my box has been a proud member of some botnet for the last
> two weeks. atm i really don't know how this could have happened. i
> just wanted to tell you guys as fast as possible.
>
> greetings,
> marcus
>
> 2012/3/5 Shawn Willden <shawn at willden.org>:
> > Yup, I can see sabotrax.
> >
> > I think that's everyone, isn't it?
> >
> >
> > On Mon, Mar 5, 2012 at 8:13 AM, <sabotrax at gmail.com> wrote:
> >>
> >> hi,
> >> i just changed the introducer and restartet tahoe.
> >> is my node kqyu52 connected? i'm just asking because i don't see it
> >> from another box that's located in the same local net (but that
> >> could be a routing issue).
> >>
> >> thanks
> >>
> >> 2012/3/3 Shawn Willden <shawn at willden.org>:
> >> > 14 nodes on the new introducer FURL now! Only one or two haven't
> >> > migrated.
> >> >
> >> >
> >> > On Fri, Mar 2, 2012 at 4:15 PM, Christoph Langguth
> >> > <christoph at rosenkeller.org> wrote:
> >> >>
> >> >> Wow!
> >> >>
> >> >> I'm absolutely amazed of you people here.
> >> >>
> >> >> It's been exactly 24 hours since we had a "911 call" on this
> >> >> list, with people distributed around the globe.
> >> >>
> >> >> Within these 24 hours, we have managed to "migrate" 2/3 of the
> >> >> infrastructure, maintained by almost 20 people, to a different
> >> >> location. And
> >> >> I'm sure that the rest of the maintainers will follow within a
> >> >> few hours (or
> >> >> when they read their mails.... jeez, it's weekend after all!).
> >> >>
> >> >> Quoting Jody, and in big letters:
> >> >> YOU ARE AWESOME!
> >> >>
> >> >> Thanks! ;-)
> >> >> -- Chris
> >> >>
> >> >>
> >> >>
> >> >> Am 01.03.2012 23:55, schrieb slush:
> >> >>
> >> >>> Hi all,
> >> >>>
> >> >>> I had deep-check cronjob on the same machine which has been
> >> >>> hacked today (see
> >> >>>
> >> >>> http://bitcoinmedia.com/compromised-linode-coins-stolen-from-slush-faucet-and-others/).
> >> >>> Although it looks like attackers come just for my bitcoins,
> >> >>> they had also access to tahoe config, so we should expect that
> >> >>> introducer furl leaked as well. How we should resolve this
> >> >>> issue?
> >> >>>
> >> >>> Best,
> >> >>> slush
> >> >>> _______________________________________________
> >> >>> volunteergrid2-l mailing list
> >> >>> volunteergrid2-l at tahoe-lafs.org
> >> >>> http://tahoe-lafs.org/cgi-bin/mailman/listinfo/volunteergrid2-l
> >> >>> http://bigpig.org/twiki/bin/view/Main/WebHome
> >> >>
> >> >>
> >> >>
> >> >>
> >> >> _______________________________________________
> >> >> volunteergrid2-l mailing list
> >> >> volunteergrid2-l at tahoe-lafs.org
> >> >> http://tahoe-lafs.org/cgi-bin/mailman/listinfo/volunteergrid2-l
> >> >> http://bigpig.org/twiki/bin/view/Main/WebHome
> >> >
> >> >
> >> >
> >> >
> >> > --
> >> > Shawn
> >> >
> >> > _______________________________________________
> >> > volunteergrid2-l mailing list
> >> > volunteergrid2-l at tahoe-lafs.org
> >> > http://tahoe-lafs.org/cgi-bin/mailman/listinfo/volunteergrid2-l
> >> > http://bigpig.org/twiki/bin/view/Main/WebHome
> >>
> >>
> >>
> >> --
> >> Give us this day our garlic bread and lead us not into
> >> vegetarianism but deliver us some pizza.
> >> _______________________________________________
> >> volunteergrid2-l mailing list
> >> volunteergrid2-l at tahoe-lafs.org
> >> http://tahoe-lafs.org/cgi-bin/mailman/listinfo/volunteergrid2-l
> >> http://bigpig.org/twiki/bin/view/Main/WebHome
> >
> >
> >
> >
> > --
> > Shawn
> >
> > _______________________________________________
> > volunteergrid2-l mailing list
> > volunteergrid2-l at tahoe-lafs.org
> > http://tahoe-lafs.org/cgi-bin/mailman/listinfo/volunteergrid2-l
> > http://bigpig.org/twiki/bin/view/Main/WebHome
>
>
>
More information about the volunteergrid2-l
mailing list