Re: [opensuse] system seems hacked... On Thu, 2008-02-21 at 17:12 +0100, Pavol Rusnak wrote:
> Roger Oberholtzer wrote:
> > You've obviously done this before. I get
> > 
> > /home/jan/mds/.font-UNIX/randfiles/.font/emech
> 
> Just for the record, emech is energymech* - IRC bot programmed in C,
> similar to eggdrop*, no exploit or rootkit fortunately.
> 
> * http://www.energymech.net/
> * http://www.eggheads.org/

Very interesting. What I am trying to figure out is how they got in. The
user they were initially using had a very difficult password with mixed
letters and numbers all chosen at random. I suspect it was via his
windows machine he logs in from. Now that my system has been found, the
bot is showing up in other users. So, I am forcing all to set new
passwords (passwd -e) and warning them that the passwords need to be
difficult. Damned pesky thing.

-- 
Roger Oberholtzer

OPQ Systems / RambÃ¶ll RST
RambÃ¶ll Sverige AB
KapellgrÃ¤nd 7
P.O. Box 4205
SE-102 65 Stockholm, Sweden

Tel: Int +46 8-615 60 20
Fax: Int +46 8-31 42 23


