[ubuntu-za] Fw: ubuntu-za Digest, Vol 58, Issue 5

Tue Jul 6 17:36:18 BST 2010


--------------------------------------------------
From: "Anton Binedell" <binedella at telkomsa.net>
Sent: Tuesday, July 06, 2010 6:23 PM
To: <ubuntu-za at lists.ubuntu.com>
Subject: Re: ubuntu-za Digest, Vol 58, Issue 5

> Re:  My Ubuntu 9.10 has been hacked. Need help
>
> Hello,
>
> I am a bit confused here. I was under the impression that Linux can't be
> hacked and are a very secure OS. Guy's please tell me that I am safe using
> Linux?
>
> --------------------------------------------------
> From: <ubuntu-za-request at lists.ubuntu.com>
> Sent: Tuesday, July 06, 2010 4:13 PM
> To: <ubuntu-za at lists.ubuntu.com>
> Subject: ubuntu-za Digest, Vol 58, Issue 5
>
>> Send ubuntu-za mailing list submissions to
>> ubuntu-za at lists.ubuntu.com
>>
>> To subscribe or unsubscribe via the World Wide Web, visit
>> https://lists.ubuntu.com/mailman/listinfo/ubuntu-za
>> or, via email, send a message with subject or body 'help' to
>> ubuntu-za-request at lists.ubuntu.com
>>
>> You can reach the person managing the list at
>> ubuntu-za-owner at lists.ubuntu.com
>>
>> When replying, please edit your Subject line so it is more specific
>> than "Re: Contents of ubuntu-za digest..."
>>
>>
>> Today's Topics:
>>
>>   1. Re:  My Ubuntu 9.10 has been hacked. Need help (Wesley)
>>   2. Re:  My Ubuntu 9.10 has been hacked. Need help (Jason Plank)
>>   3. Re:  My Ubuntu 9.10 has been hacked. Need help (Hilton Gibson)
>>   4. Re:  My Ubuntu 9.10 has been hacked. Need help (Mike Purves)
>>   5. Re:  My Ubuntu 9.10 has been hacked. Need help (Alf Stockton)
>>   6. Re:  Nvidia FX5500 with 10.04 (Andre Rossouw)
>>
>>
>> ----------------------------------------------------------------------
>>
>> Message: 1
>> Date: Tue, 6 Jul 2010 12:10:42 +0000
>> From: "Wesley" <wesley.werner at gmail.com>
>> Subject: Re: [ubuntu-za] My Ubuntu 9.10 has been hacked. Need help
>> To: "Ubuntu South African Local Community"
>> <ubuntu-za at lists.ubuntu.com>
>> Message-ID:
>> <637040835-1278418241-cardhu_decombobulator_blackberry.rim.net-1874170468- at bda049.bisx.produk.on.blackberry>
>>
>> Content-Type: text/plain
>>
>> My thoughts exactly Robert.
>>
>> Jason to get the IP of the machine you're browsing from, go to
>> http://www.whatismyip.com but that could just show your proxy's IP if you
>> are behind one.
>> [Sent via my BB:21F7F343]
>>
>> -----Original Message-----
>> From: Robert <robket at gmail.com>
>> Sender: ubuntu-za-bounces at lists.ubuntu.com
>> Date: Tue, 6 Jul 2010 14:02:26
>> To: Ubuntu South African Local Community<ubuntu-za at lists.ubuntu.com>
>> Reply-To: Ubuntu South African Local Community
>> <ubuntu-za at lists.ubuntu.com>
>> Subject: Re: [ubuntu-za] My Ubuntu 9.10 has been hacked. Need help
>>
>> -- 
>> ubuntu-za mailing list
>> ubuntu-za at lists.ubuntu.com
>> https://lists.ubuntu.com/mailman/listinfo/ubuntu-za
>>
>>
>>
>>
>>
>> ------------------------------
>>
>> Message: 2
>> Date: Tue, 6 Jul 2010 14:14:12 +0200
>> From: Jason Plank <plank.jason at gmail.com>
>> Subject: Re: [ubuntu-za] My Ubuntu 9.10 has been hacked. Need help
>> To: wesley.werner at gmail.com, Ubuntu South African Local Community
>> <ubuntu-za at lists.ubuntu.com>
>> Message-ID:
>> <AANLkTilKoe1SB0bDWLs5f4GX9LIFq2TWNx9vrqEuGecm at mail.gmail.com>
>> Content-Type: text/plain; charset="utf-8"
>>
>> Hi there
>>
>> The address it gives just goes to our ADSL router. I don't know how the
>> guy
>> was getting to the pc as it definitely isn't an internal person. At the
>> moment, things seem ok, but I'll keep checking. It would stay fine for a
>> while, then he would do something :-(
>>
>> Jason
>>
>> On Tue, Jul 6, 2010 at 2:10 PM, Wesley <wesley.werner at gmail.com> wrote:
>>
>>> My thoughts exactly Robert.
>>>
>>> Jason to get the IP of the machine you're browsing from, go to
>>> http://www.whatismyip.com but that could just show your proxy's IP if 
>>> you
>>> are behind one.
>>> [Sent via my BB:21F7F343]
>>>
>>> -----Original Message-----
>>> From: Robert <robket at gmail.com>
>>> Sender: ubuntu-za-bounces at lists.ubuntu.com
>>> Date: Tue, 6 Jul 2010 14:02:26
>>> To: Ubuntu South African Local Community<ubuntu-za at lists.ubuntu.com>
>>> Reply-To: Ubuntu South African Local Community
>>> <ubuntu-za at lists.ubuntu.com
>>> >
>>> Subject: Re: [ubuntu-za] My Ubuntu 9.10 has been hacked. Need help
>>>
>>> --
>>> ubuntu-za mailing list
>>> ubuntu-za at lists.ubuntu.com
>>> https://lists.ubuntu.com/mailman/listinfo/ubuntu-za
>>>
>>>
>>>
>>> --
>>> ubuntu-za mailing list
>>> ubuntu-za at lists.ubuntu.com
>>> https://lists.ubuntu.com/mailman/listinfo/ubuntu-za
>>>
>>
>>
>>
>> -- 
>> Nothing is as wonderful as knowing Christ Jesus my Lord. I have given up
>> everything else and count it all as garbage. All I want is Christ -
>> Philippians 3:8 CEV
>> -------------- next part --------------
>> An HTML attachment was scrubbed...
>> URL:
>> https://lists.ubuntu.com/archives/ubuntu-za/attachments/20100706/c1ff7d2d/attachment-0001.htm
>>
>> ------------------------------
>>
>> Message: 3
>> Date: Tue, 06 Jul 2010 14:18:45 +0200
>> From: Hilton Gibson <hilton.gibson at gmail.com>
>> Subject: Re: [ubuntu-za] My Ubuntu 9.10 has been hacked. Need help
>> To: ubuntu-za at lists.ubuntu.com
>> Message-ID: <4C331F25.6050709 at gmail.com>
>> Content-Type: text/plain; charset="iso-8859-1"
>>
>> Hi Jason
>>
>> Also check this: http://www.ubuntu.sun.ac.za/wiki/index.php/NetworkSafety
>>
>> Cheers
>>
>> hg
>>
>> On 06/07/2010 14:14, Jason Plank wrote:
>>> Hi there
>>>
>>> The address it gives just goes to our ADSL router. I don't know how
>>> the guy was getting to the pc as it definitely isn't an internal
>>> person. At the moment, things seem ok, but I'll keep checking. It
>>> would stay fine for a while, then he would do something :-(
>>>
>>> Jason
>>>
>>> On Tue, Jul 6, 2010 at 2:10 PM, Wesley <wesley.werner at gmail.com
>>> <mailto:wesley.werner at gmail.com>> wrote:
>>>
>>>     My thoughts exactly Robert.
>>>
>>>     Jason to get the IP of the machine you're browsing from, go to
>>>     http://www.whatismyip.com but that could just show your proxy's IP
>>>     if you are behind one.
>>>     [Sent via my BB:21F7F343]
>>>
>>>     -----Original Message-----
>>>     From: Robert <robket at gmail.com <mailto:robket at gmail.com>>
>>>     Sender: ubuntu-za-bounces at lists.ubuntu.com
>>>     <mailto:ubuntu-za-bounces at lists.ubuntu.com>
>>>     Date: Tue, 6 Jul 2010 14:02:26
>>>     To: Ubuntu South African Local
>>>     Community<ubuntu-za at lists.ubuntu.com
>>>     <mailto:ubuntu-za at lists.ubuntu.com>>
>>>     Reply-To: Ubuntu South African Local Community
>>>     <ubuntu-za at lists.ubuntu.com <mailto:ubuntu-za at lists.ubuntu.com>>
>>>     Subject: Re: [ubuntu-za] My Ubuntu 9.10 has been hacked. Need help
>>>
>>>     --
>>>     ubuntu-za mailing list
>>>     ubuntu-za at lists.ubuntu.com <mailto:ubuntu-za at lists.ubuntu.com>
>>>     https://lists.ubuntu.com/mailman/listinfo/ubuntu-za
>>>
>>>
>>>
>>>     --
>>>     ubuntu-za mailing list
>>>     ubuntu-za at lists.ubuntu.com <mailto:ubuntu-za at lists.ubuntu.com>
>>>     https://lists.ubuntu.com/mailman/listinfo/ubuntu-za
>>>
>>>
>>>
>>>
>>> -- 
>>> Nothing is as wonderful as knowing Christ Jesus my Lord. I have given
>>> up everything else and count it all as garbage. All I want is Christ -
>>> Philippians 3:8 CEV
>>
>> -- 
>> Hilton Gibson
>> Systems Administrator
>> JS Gericke Library Room 1025D
>> Stellenbosch University
>> Private Bag X5036
>> Stellenbosch
>> 7599
>> South Africa
>>
>> Tel: +27 21 808 4100 | Cell: +27 84 646 4758
>>
>> -------------- next part --------------
>> An HTML attachment was scrubbed...
>> URL:
>> https://lists.ubuntu.com/archives/ubuntu-za/attachments/20100706/67fd43ce/attachment-0001.htm
>>
>> ------------------------------
>>
>> Message: 4
>> Date: Tue, 6 Jul 2010 14:23:15 +0200
>> From: Mike Purves <michael.purves at gmail.com>
>> Subject: Re: [ubuntu-za] My Ubuntu 9.10 has been hacked. Need help
>> To: Ubuntu South African Local Community <ubuntu-za at lists.ubuntu.com>
>> Message-ID:
>> <AANLkTilYRpJq-ldCKD1e1nLDEt4eMYouFXqvv1yDINiq at mail.gmail.com>
>> Content-Type: text/plain; charset="iso-8859-1"
>>
>> What about wifi access.  Someine in the vacinity has connected to your
>> work
>> and has found that linux box...perhaps even opened up a back door for
>> himself....
>>
>> Check the users on that machine...perhaps you should acitivate the root
>> user
>> with a strong password...Check your wifi settings, dont use WEP etc etc
>>
>> The person is gaining access a limited number of ways...Need to check 
>> them
>> one by one.
>>
>>
>> Regards
>>
>> MP75
>> On Tue, Jul 6, 2010 at 2:14 PM, Jason Plank <plank.jason at gmail.com> 
>> wrote:
>>
>>> Hi there
>>>
>>> The address it gives just goes to our ADSL router. I don't know how the
>>> guy
>>> was getting to the pc as it definitely isn't an internal person. At the
>>> moment, things seem ok, but I'll keep checking. It would stay fine for a
>>> while, then he would do something :-(
>>>
>>> Jason
>>>
>>>
>>> On Tue, Jul 6, 2010 at 2:10 PM, Wesley <wesley.werner at gmail.com> wrote:
>>>
>>>> My thoughts exactly Robert.
>>>>
>>>> Jason to get the IP of the machine you're browsing from, go to
>>>> http://www.whatismyip.com but that could just show your proxy's IP if
>>>> you
>>>> are behind one.
>>>> [Sent via my BB:21F7F343]
>>>>
>>>> -----Original Message-----
>>>> From: Robert <robket at gmail.com>
>>>> Sender: ubuntu-za-bounces at lists.ubuntu.com
>>>> Date: Tue, 6 Jul 2010 14:02:26
>>>> To: Ubuntu South African Local Community<ubuntu-za at lists.ubuntu.com>
>>>> Reply-To: Ubuntu South African Local Community <
>>>> ubuntu-za at lists.ubuntu.com>
>>>> Subject: Re: [ubuntu-za] My Ubuntu 9.10 has been hacked. Need help
>>>>
>>>> --
>>>> ubuntu-za mailing list
>>>> ubuntu-za at lists.ubuntu.com
>>>> https://lists.ubuntu.com/mailman/listinfo/ubuntu-za
>>>>
>>>>
>>>>
>>>> --
>>>> ubuntu-za mailing list
>>>> ubuntu-za at lists.ubuntu.com
>>>> https://lists.ubuntu.com/mailman/listinfo/ubuntu-za
>>>>
>>>
>>>
>>>
>>> --
>>> Nothing is as wonderful as knowing Christ Jesus my Lord. I have given up
>>> everything else and count it all as garbage. All I want is Christ -
>>> Philippians 3:8 CEV
>>>
>>> --
>>> ubuntu-za mailing list
>>> ubuntu-za at lists.ubuntu.com
>>> https://lists.ubuntu.com/mailman/listinfo/ubuntu-za
>>>
>>>
>> -------------- next part --------------
>> An HTML attachment was scrubbed...
>> URL:
>> https://lists.ubuntu.com/archives/ubuntu-za/attachments/20100706/3d192270/attachment-0001.htm
>>
>> ------------------------------
>>
>> Message: 5
>> Date: Tue, 06 Jul 2010 14:47:33 +0200
>> From: Alf Stockton <alf at stockton.co.za>
>> Subject: Re: [ubuntu-za] My Ubuntu 9.10 has been hacked. Need help
>> To: Ubuntu South African Local Community <ubuntu-za at lists.ubuntu.com>
>> Message-ID: <4C3325E5.1060800 at stockton.co.za>
>> Content-Type: text/plain; charset=UTF-8; format=flowed
>>
>> On 06/07/2010 12:52, Jason Plank wrote:
>>> Hi Guys
>>>
>>> I hope someone can help or give me some advice. I've got Ubuntu 9.10
>>> running on one of our pc's at work as a LAMP server for joomla and I've
>>> also got virtualbox installed running NT4 workstation for a project
>>> we're working on. My problem is that some idiot has hacked the system
>>> and I can't seem to block him. I've tried turning of Remote Desktop, but
>>> he still get's in and changes settings. I've also disabled a whole bunch
>>> of startup daemons. We're also behind a DLINK DFL-210 firewall and I've
>>> set it to drop incoming RDP and telnet connections, but he still seems
>>> to be getting in. Can anyone give any ideas as to what I can do, other
>>> than format and redo the system?
>>>
>> To identify who logged into my server and from where I have entered the
>> following in my /etc/profile on my debian server.
>>
>> echo "Subject: Login on `hostname`" > ./logon.txt
>> echo "by `who | awk '{print $1}'` from URL `who | awk '{print $5}'`" >>
>> ./logon.txt
>> /usr/sbin/sendmail -t alf at stockton.co.za < ./logon.txt
>>
>>
>> -- 
>> ---
>>
>> Regards,
>> Alf Stockton www.stockton.co.za
>>
>> To err is human, to forgive canine.
>>
>>
>>
>> ------------------------------
>>
>> Message: 6
>> Date: Tue, 06 Jul 2010 16:13:13 +0200
>> From: Andre Rossouw <andre at arnet.co.za>
>> Subject: Re: [ubuntu-za] Nvidia FX5500 with 10.04
>> To: Ubuntu South African Local Community <ubuntu-za at lists.ubuntu.com>
>> Message-ID: <1278425593.10453.6.camel at pe-andrer-5>
>> Content-Type: text/plain; charset="utf-8"
>>
>> Hi, thanks for the response.
>>
>> On Tue, 2010-07-06 at 13:09 +0200, Wesley Werner wrote:
>>> Which Ubuntu version are you running? Have a look here too:
>>> https://help.ubuntu.com/community/NvidiaManual
>>
>> I'm using 10.04. I'll give that a go this weekend and see how it goes.
>> -- 
>> Andre Rossouw <andre at arnet.co.za>
>> -------------- next part --------------
>> A non-text attachment was scrubbed...
>> Name: not available
>> Type: application/pgp-signature
>> Size: 198 bytes
>> Desc: This is a digitally signed message part
>> Url :
>> https://lists.ubuntu.com/archives/ubuntu-za/attachments/20100706/6651b13a/attachment.pgp
>>
>> ------------------------------
>>
>> -- 
>> ubuntu-za mailing list
>> ubuntu-za at lists.ubuntu.com
>> https://lists.ubuntu.com/mailman/listinfo/ubuntu-za
>>
>>
>> End of ubuntu-za Digest, Vol 58, Issue 5
>> ****************************************
> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2008 bytes
Desc: not available
Url : https://lists.ubuntu.com/archives/ubuntu-za/attachments/20100706/9181aded/attachment.bin