[NTLUG:Discuss] SRJ servers hacked and destroyed!

[Daniel L. Shipman]

SRJ servers hacked and destroyed!

For the past 3 days I have been defending the SRJ servers from hacking
invaders from Kuwait, Brazil, Plano, Sherman, and somewhere in WY.

The hackers scanned ports, entered in with FTP and telnet by utilizing
AdmRocks to overflow the Named buffer. I was running Bind 8.2.1 - I strongly
encourage anyone who is running bind to upgrade to bind 8.2.2 Patch 5

The folks who hacked me are called the "Shitkingz" they replaced the
index.html file for each users public_html directory with their own which
included child pornography images pulled from  a geocities account

I was first informed of the attack by attrition.org - the most disgusting
business organization in the world - I contacted the FBI ASAP and have been
working with them non stop.

Thus far I have incurred in excess of $14,500 in lost time, billing, and
revenue

Prior to format on July 5th I ran dd on the HD followed by strings and saved
the image of the hacked drive to seperate files on the same HD. The parsed
date I was able to recover and save before the format, partitioning, and
re-install of the HD have been forwarded to the FBI. I have access to copies
of /etc /var /bru /root that were made on July 5. I know they used the
AdmRocks kit because I found a folder in /var/named called "Admrocks". A
searched of the file system for "\.\.\." found nothing. All logs were rm'd
and many files, including wtmp were linked to /dev/null. The only reason I
was able to get the logs I did was because they didn't zero out the files
prior to rming them.

Just though you all would like to know whats been going on around my place

++++++++++++++++++++++++++++
Daniel L. Shipman, Webmaster
SRJ Marketing Communications
214.528.5775
++++++++++++++++++++++++++++
So, there I was, lying, cheating and back-stabbing my way up the corporate
ladder, feeling pretty darn good about myself, when someone told me the 'J'
in 'WWJD' meant *Jesus* I thought it meant *Judas*!  Hoo boy, am I red in
the face!