Welcome to the Linux Foundation Forum!

Am I getting hacked? RESOLVED

RickSMO
RickSMO Posts: 123
in Linux Security

First windows 7 crashes and blue screens, but i'm on a dual boot system, then my Kubuntu was acting weird and "Seemed" to be randomly deleting stuff, I suppose I could be wrong on that but it was odd because every time I rebooted it would ask for confirmation on deleting a ton of my drivers, which i did not want delete and don't know why it even came up. Then I re-install using ubuntu 10.10, and as soon as I install and configure my firewall, it blocks this IP Address 216.156.249.139

Question, what now? How do I know if its a real threat or coincidence? Or are there any coincidence's when it comes to my firewall blocking IPs on weird ports? it was on port : 57243

[Answer: Yes, Yes I am.]

Comments

  • mfillpot
    mfillpot Posts: 2,177
    It looks like both installations may have been compromised. I have never heard of any attach such as that on a personal Linux installation, so this is indeed strange, but it is good that the firewall caught the attempted communications and blocked them.

    Judging by the port that the intruder was attempting to use it looks like they were using the port to access both installations, but I am at a loss trying to figure out how they got in unless you installed some questionable application as root.
  • marc
    marc Posts: 647
    From the Tor documentation site:
    While Tor blocks attackers on your local network from discovering or influencing your destination, it opens new risks: malicious or misconfigured Tor exit nodes can send you the wrong page, or even send you embedded Java applets disguised as domains you trust. Be careful opening documents or applications you download through Tor, unless you've verified their integrity.

    Bad news then :(

    RSims wrote:
    Anything you would recommend I do to further my security? I am running ubuntu 10.10 desktop now with the origonal gnome II desktop.

    Block everything, INPUT, FORWARD and OUTPUT chains in iptables. From there on, allow just what you want or need ( ports 20,21,22,80, 443,465,,631,993 are common).

    Well, security is a complicated matter....

    Regards
  • jacklaws
    jacklaws Posts: 1
    Format is the best solution ,although it is cumbersome.

Categories

Upcoming Training