How does one know if an intruder had secretly accessed one's system? Does system log help? It seems it does but I am yet to figure out how to understand those files. Can anybody please help? Or are there other ways to confirm that. It may happen that the intruder had accessed some vital information but so far had not done anything malicious.
View 2 Replies[URL] This web page says: "The team set up weak security on four Linux computers with Internet access, then recorded what happened as the individual machines were attacked. They discovered the vast majority of attacks came from relatively unsophisticated hackers using "dictionary scripts," a type of software that runs through lists of common usernames and passwords attempting to break into a computer."
How did they "record what happened as the individual machines were attacked"? How did they figure out that "the vast majority of attacks came from relatively unsophisticated hackers using 'dictionary scripts'"? What I am really getting at is that I've searched the net and found lots of advice on how to detect if your computer has been hacked but I haven't found ways to know if your computer is being attacked. Obviously, this group did that.
I have noticed some possible security issues in my /var/log.messages log but i'm not sure how to read the messages.
I'm getting the following lines:
Code:
Had a couple of problems with one of my leased web/mail servers, including mail was having trouble and it was reporting disk full (when a df showed it wasn't). I did a chkrootkit and got this:
Checking `ifconfig'... INFECTED
Checking `netstat'... INFECTED
Checking `pstree'... INFECTED
Checking `top'... INFECTED
[code]....
I am working on comparitive study of mobility models on intruder detection. An ns2 code for detecting an intruder is required.
View 2 Replies View RelatedAdvised on another forum to install XP pro then Linux on HD. Decided to try it. Not that savy with computers and have a mini-laptop in addition to desktop that was attacked. Virus
cause most programs to fail. Disc was nearly full (250GB) so I'm buying a refurbed Seagate (500GB) and need to learn to back up files onto flash drive or something. Lost a lot of photos and emails that were good reference material. Heard a lot about Linux so I'm going to give it a try.
I was looking at my firewall(firestarter) logs. It shows that a program named Master's Paradise has been trying to make connections to outside from my computer on port 3129. Why would I have something like this on my machine? Is this something I need to be worried about?? Or is some legitimate program using port 3129 and the firewall log is still showing it as Master's Paradise?
View 9 Replies View RelatedI have windows computer and it is being hacked.About month ago or more some one hacked my router and install new firmware from Firmware Version: Talisman/Basic V1.2.9a
My router is linksys and SSID got changed to sveasoft.I had WPA set up and MAC filtering .
Some one hacked my router and change Firmware Version.And user name and password also got change to just admin.
Well now I got a pop up from my Kaspersky saying network attack scan.generic.TCP 74.63.245.168
only thing I can find on it http://whatismyipaddress.com/ip/74.63.245.168
It is Limestone Networks in Dallas.
Some strang things have been happing to my computer in past 4 months and is getting worse.
I have no firewall or router now.And have not gone to the store and get new router yet and I'm thinking of formatting my computer and putting linux and get good firewall like zone-alarm.
VERY GREEN to Ubuntu. My setup:
1. computer A connects to the internet through usb dial up modem
2. computer A & B are wirelessly networked through an ADHOC network.
3. computer B doesnot need to connect to the internet.
I've installed the GUFW. If I enable it I can not see the other computer files. I use static IPs for both. I tried setting a rule but I get stumped were it asks for the port. I'm not all that familiar with ports.
I have a creative pc cam 300 that i have been trying to set up as a security camera, on a computer running ubuntu 9.10. I tried installing the spca5xx driver, but i can only find it for old versions of ubuntu and it doesnt work. Does anyone know how to get the driver working?
View 3 Replies View RelatedI work in a retail store at which there is a computer set up in the corner for customers to browse the stores website on. The problem is that that is all it will let me do. I get board, and want to do other stuff. Once windows starts, it skips the logon on screen and once loaded the only thing that can be done on the computer is browse the stores website.
However, if I unplug the computer I can while its starting up get into BIOS. So here im wondering two things. 1) If I put in the USB, boot from it, and load ubuntu (even though I will only be able to use the default programs as theres no way I would want to install it on the work computer), will I get fired? In other words, is there a way if there monitoring the computers to know what im doing or because its a different OS will I be fine. 2) Alternatively, in BIOS there is an option to disable network administration.
For this my question is the same, if I disable it, do fun stuff on the computer all day, the re-enable it before I leave is there a high change of the network administration catching on to this or no.
I have very little security and networking experience. What can I do to make my computer more secure?
View 5 Replies View RelatedFor a while my ISP has been sending me emails regarding an infected computer or computers on my local network. There are 4 computers running linux and 3 running windows on said network (3x ubuntu, gentoo, 2x windows server 2003 and windows 7).Now, I haven't used Windows in oh so many years and am not responsible for those computers on this network. Does it seem like this is a virus on a Windows host or should I research and adjust my iptables settings on the router? The applied anti-virus software (I don't know which one) apparently does not find any infections. On my workstation I'm using spotify and win32 office through wine, both obtained from legal and trusted sources, and would thus not consider my wine environment a threat.
View 4 Replies View Relatedmy computer has been surely hacked for at least more than two months; my private information are being hacked and spread around! I initally used Windows Vista and I had the firewall off and no antivirus software. When I realized that my OS had been hacked, I began turning my firewall on and installing security softwares, but nothing stopped the hack.
Yesterday, I erased all my partitions and installed Ubuntu 10.10. I installed rkhunter and a firewall. I changed my static IP adress, at least for the sake of knowledge, to another one, then I got disconnected since my router only allows my old IP.
When I'm about to write my admin password, I disconnect from the network. I've scanned my system using rkhunter, and the result is a list of 30 suspicious files!
Can I adjust my router in a way that it can allow any IP adress? If yes, can I have a non-static IP adress? How to prevent the hacking in the first place? However, I believe, I don't know yet, that my Ubuntu has also been hacked...
If I can't get rid of the hacker(s), then I should permanently disconnect from internet and find another way to receive information anonymously through the internet.
My laptop randomly shuts off, at first I thought it was an issue with the laptop overheating but during the install of 11.04 I made sure the laptop had a fan blowing on it constantly and checked it and determined it couldn't have overheated. My problem now is that I was able to use a live cd to access my old files but was presented with only two files stating that my files were encrypted, I'm don't ever recall encrypting my files and so I'm without a passphrase.
What I'm wondering, is there a way to gain access without the passphrase? Or is there a way to fix the corrupt install?
I am going to try to install Tripwire on my computer. I do not know why or how to configure Tripwire policy and configuration files.
View 1 Replies View RelatedReading from this article New Flash Bug Exploited By Hackers : How to avoid it? In particular the article said
Quote:
A new attack on a Flash bug has surfaced that would give attackers control of a victim�s computer after crashing it, reports PC World. Adobe put out a Security Advisory about this on June 4. It is categorized as a critical issue and all operating systems with Flash are vulnerable including Windows, Linux, and Apple and it is also found in the recent versions of Reader and Acrobat.
mpg123 suddenly started playing a police siren occationly. I checked the process once I heard it, and root was the process owner. How could this happen? Have someone broke into my computer? If so - how could I verify an attack? I run Ubuntu 9.10.
View 2 Replies View RelatedI recently ran a virus scan on my CentOS server using ClamAV's "clamscan" command to scan my entire system for virus. After the scan was complete it says that I have 1 infected file on my computer. I COMPLETELY FREAKED OUT! Is there some kind of log that I should read to see where the infected files are? Also does ClamAV just scan your system for virus or does it scan and remove the virus on the computer.If you know of an alternative open source security software,
View 3 Replies View RelatedI'm now running Ubuntu 9.04. There are 2 accounts on this computer, one is linux, the other is ubuntu. Before New year, everything had been fine. But after new year, I came back and found that the password of this account linux has been changed. So I fixed using my rescue disk. But since that day on, it seems that this password changes everyday somehow. Everyday when I'm trying to log into my Ubuntu System using the account linux, it says login failed. However, i can still login using the account ubuntu. I'm really confused. Why is this? I checked the date of expiry. Everything seems to be fine.
View 14 Replies View RelatedWhat I want to do is pull data from any of the hard drives attached to my Linux box from my Windows machine. I have been moving small amounts of data from the drives to my OS drive and those parts share easily, but I want to move away from that method to move large amounts of data at the same time.I have tried using Samba as it is used for file sharing between systems and that I have to give my Windows box permission through Samba.
Trick is, I'm not sure where to start, though I have an idea and wanted to know if this is the right track before I start editing my file system.
On my HTPC/Server unbuntu box I have installed logwatch in order to get a daily look on my computer activity.
And I often have this line in the report :
Quote:
root => my_user
-------------
/usr/bin/gconftool - 3 Times.
The corresponding line in auth.log are :
Quote:
./auth.log:Jan 28 07:59:31 sweetBox sudo: root : TTY=unknown ; PWD=/ ; USER=my_user ; COMMAND=/usr/bin/gconftool --get /system/http_proxy/use_http_proxy
./auth.log:Jan 28 07:59:32 sweetBox sudo: root : TTY=unknown ; PWD=/ ;
[Code].....
So I forgot how to do something in Compiz and I quickly Googled it to find the answer. On the first or second link I clicked, a pop-up box opened from Firefox saying that I should scan my computer. Immediately, I pressed the X button, but a page started to load that tried to "scan" my computer. I closed out Firefox and re-opened it. I did the exact same search again on Google, but I clicked on the cached view of the site. It was harmless enough--a blog with some ads on the side of the page. I'm assuming that it was one of the ads that somehow must have taken over the page.
Anyway, I know that the discussion of anti-virus programs is not anything new, but I would like to know if this virus may have affected Ubuntu. What would you guys recommend in this case?Also, after running the update manager, I received a pop-up box asking if I would like to update Grub. Is this a normal part of the update, or could it be a virus? I'm a bit paranoid, being from the land of Windows.
How do I scan a windows computer from my Ubuntu laptop via the network? I have Ubuntu 10.04 on my laptop. First Windows computer to scan has Windows XP Home Edition Second Windows computer to scan has Windows Vista Home Basic I have Avast 4 workstation and KlamAV insalled on it. What is the steps to make my computer scan those windows computers. And how do I set up my firewall to work with firefox and empathy?
View 5 Replies View RelatedOur local community wants to provide broadband access for people who don't own a computer. I have been given the task of setting this up and I am going to use Ubuntu. Internet access will be via a usb dongle to a T-Mobile 3.5g network. Initially we are intending to limit access to just Internet browsing. Most users will probably be older people, rather than teenage hackers. configuring/securing a default Ubuntu install for this sort of use.
View 3 Replies View RelatedSome how I seem to be locked out of my desktop computer. My password isn't working. For some reason all of a sudden it seems to have stopped working. I tried to reboot and now I'm locked out, I can't login. And I'm the only sudo user. How can I fix it or even reset my password
View 2 Replies View Relatedmy computer froze solid, and it would not react to anything. X didn't react to Ctrl+Alt+Backspace, not Ctrl+Alt+Del, so I had to turn it off using the power button.
This is the first time my computer freezes like this, the log files did not reveal any HW errors. Is it possible that someone in the channel did not like my level of Java skill, and flooded me to disconnect?
By the way; Im using slackware 13.1 with the default kernel (2.6.33.4) and irssi as IRC client.
I know that if you eg. ICMP-flood someone, the traffic will be denied and, but can it provoke other behavior from the computer?
So my question is; can a IRC flood/DDoS attack cause a computer to freeze sub zero?
Quote:
The 605-page PDF document reads like a listing of the pros and cons for a huge array of defensive and counterintelligence approaches and technologies that an entity might adopt in defending its networks. Of particular interest to me was the section on deception technologies, which discusses the use of honeynet technology to learn more about attackers� methods, as well as the potential legal and privacy aspects of using honeynets. Another section delves into the challenges of attributing the true origin(s) of a computer network attack.
my son is 15, autistic and mentally retarded. he is moderate-low functioning and loves to watch barney the dinosaur, thomas the tank engine and other young children's programming on videos on his computer. he can talk in a limited way and can read out loud at about the first-grade level, though he seems to have little or no comprehension of what he's read (hyperlexia).i'm having problems with viruses and spyware because he lacks the judgment that keeps the rest of us from clicking on every window that pops up. we've had a particularly nasty crop of ad-ware viruses lately that pops up graphic porn ads even when the browser is closed. i've had enough of this.
the computer is an ancient dell dimension 4600 desktop (circa ~2002) running windows xp. i've run ubuntu from a live cd and installed flash as a test. videos videos play fine, so that's not a problem. i don't really want to replace the computer becasue it still works and is only used by him to run firefox. i am willing to buy a new computer if that turns out to be the only option.i've been using ubuntu exclusively on my laptop for several years and i would like to remove windows from his computer and replace it with ubuntu. i'm wondering how i can make his computer as accessible as possible to him while not sacrificing too much security.my son has very poor fine motor control over his hands. he can use a mouse with some difficulty, but using a keyboard is out of the question. he can use the mouse to click on the shortcuts to his favorite videos, but i can't think of how he would be able to enter a password for his account. not only does he have the fine motor problem, but he is not able to remember any usefully secure password.
does anyone have any ideas about how to make his computer accessible to him without opening a gaping security hole? two ideas that i've kicked around are creating a user with absolutely the minimum privileges required to use firefox and no password or finding some way to enter a password that doesn't require a keyboard. i haven't come up with how to implement either of those ideas successfully.
are there any programs that will protect my computer on the Internet. Just started using fed 10 from windows so i am not sure what i need to do. I am using an acer aspire 5630 laptop.
View 1 Replies View Related