SS: Work server hacked

[Memo]

So, the main server at work here got hacked and I have no idea how. Some ******* came in and changed the root password and deleted all other accounts, installed apache, an irc bounce, created a bunch of empty directories which seem to be preparing it to become a warez dump :dead:.

[Cubsfan]

Not very sneaky, are they? Seems like if they really wanted that plan to work, they wouldn't have necessarily changed the root passwords. That's likely to get noticed quickly.

What OS?

[Memo]

Unix.

They didn't change the passwords on me till I stopped the Apache server they had installed. The ****tiest part is that I have no idea how they got in.

[Cubsfan]

Ahh, so they didn't change it until they knew they were caught. I'm guessing you can recover?

[Memo]

We're running on the slave so we're ok for now, but I guess without finding the source of the intrusion I can't truly be "safe."

The kicker is the *******s at the IT department of our sister company changed the password to MY router here. When I inquired about it they denied changing it. They then admitted it and refused to give it to me because they didn't trust me with the bridge between our 2 LANs (eventhough I set it up and walked them through the set up of the router on their side :rolleyes:). It realy makes me think they are the ones who did this. Either way, I contacted directly to the Cisco router and recovered and changed the passwords myself.

[Prngr44]

Sounds like some drama!