has my 10.1-RELEASE system been compromised
Jung-uk Kim
jkim at FreeBSD.org
Wed Feb 25 20:01:31 UTC 2015
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
On 02/25/2015 14:41, Joseph Mingrone wrote:
> This morning when I arrived at work I had this email from my
> university's IT department (via email.it) informing me that my host
> was infected and spreading a worm.
>
> "Based on the logs fingerprints seems that your server is infected
> by the following worm: Net-Worm.PHP.Mongiko.a"
>
> my ip here - - [23/Feb/2015:14:53:37 +0100] "POST
> /?cmd=info&key=f8184c819717b6815a8b8037e91c59ef&ip=212.97.34.7
> HTTP/1.1" 200 429 "-" "Net- Worm.PHP.Mongiko.a"
>
> Despite the surprising name, I don't see any evidence that it's
> related to php. I did remove php, because I don't really need it.
> I've included my /etc/rc.conf below. pkg audit doesn't show any
> vulnerabilities. Searching for Worm.PHP.Mongiko doesn't show
> much. I've run chkrootkit, netstat/sockstat and I don't see
> anything suspicious and I plan to finally put some reasonable
> firewall rules on this host.
>
> Do you have any suggestions? Should I include any other
> information here?
...
I found this:
http://security.stackexchange.com/questions/82273/what-is-net-worm-php-mongiko-trying-to-do
Jung-uk Kim
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQEcBAEBCAAGBQJU7ioVAAoJEHyflib82/FGXjoH/if/ZIuW6/KvVD0fYJ7Mfmkj
wkB7BzfYcE2KQ4PomwWzEUoyc1b2RNZ9a0b/FaxMK3xUGwbKqchiCT+KlHUAdWRc
ifK9dOMg/DRtmacmo718k4SZghPlHY1AtB0I65vo7YSWCMxQJkgY9cxdKIvdoLkd
ujV2+yFjmg2zKM7bDkoCt2c34iUODUeXm2FUPIjVYCycwusDhXY2WZ+AZTmgDdQA
O8AlLRgSTjN53VdiK8HTW3Q5JTDtCymHNT8Oj8MZoEYwkOuh1jQnAaGrWaS1wQo4
MtiqShnKLZoyKPZYll84r0aCTqt997ZhhVYqsO13Db8Ev66pC56niQy31FfCfbw=
=0dgN
-----END PGP SIGNATURE-----
More information about the freebsd-security
mailing list