Re: [cobalt-security] RAq 3 Hacked ( all over the glode ?! )

[Gossi The Dog <gossi@xxxxxxxxxxxxxx>]

On Sun, 11 Feb 2001, ICDServers wrote:

> Hi All,
>
> I'm just wondering if i'm the only one suffering from this or are there more
> people that have been hacked this weekend.
> I HAD a raq3 and some crappy hacker has deleted all files in the /VAR
> folder, this disables the entire raq.
> Somehow they have maneged to get into the raq at a root level and there
> created a mess of things.
> Fortunalty i'm online again, this time on a raq 4 but i still wonder if i
> should block certain sites form accessing the server and if so what sites ?
>
> Can anyone here advise me ? I have installed all updates for the raq 4 that
> are currently available.
>
> regards,
>
> Peter Broerse
> ICDServers
> info@xxxxxxxxxxxxxx

You were probably hacked via bind.  Install the new BIND rpm (not listed
on the website yet) or you will likely be hacked again.

/var was probably removed in an attempt to hide logs.  However, whoever
did this isn't very clueful (they should have been fiddling with /var/log
for starters, not the whole of /var).

HTH,
Gossi.