Rootshell.com hacked via SSH
Anybody here have any idea how this was done? This one has me rather concerned... http://www.rootshell.com/beta/news.html On Wed Oct 28th at 5:12AM PST the main Rootshell page was defaced by a group of crackers. Entry to the machine was made via SSH (secure shell) which is an encrypted interface to the machine at 04:57AM PST this morning. Rootshell was first informed of this incident at 6:00 AM PST and the site was immediately brought offline. The site was back up and operational by 8:00AM PST. We are still in the process of investigating the exact methods that were used. The paranoid MAY want to disable ssh 1.2.26. Rootshell runs Linux 2.0.35, ssh 1.2.26, qmail 1.03, Apache 1.3.3 and nothing else. The attackers used further filesystem corruption to make it harder to remove the damaged HTML files. -- Lucky Green <shamrock@cypherpunks.to> PGP v5 encrypted email preferred.
participants (1)
-
Lucky Green