-----Ursprüngliche Nachricht----- Von: Daniel Schulz [i-smo] [mailto:daniel@i-smo.de] Gesendet: Montag, 26. August 2002 11:02 An: 'Mario Ohnewald'; 'suse-security@suse.com' Betreff: AW: [suse-security] I think i got "hacked" (german) Hi, from your description I get that one of your Linux boxes is a router. I dont think that a possible attacker got into the W2k Box of your sister. And a professional would not spend much time into "hacking" your sisters box. In my opinion, its whether someone who knows your sister and wants to joke on her, or he probably guessed the password of her Webmail account. Best regards, Daniel Schulz -----Ursprüngliche Nachricht----- Von: Mario Ohnewald [mailto:mario.ohnewald@gmx.de] Gesendet: Montag, 26. August 2002 10:46 An: suse-security@suse.com Betreff: [suse-security] I think i got "hacked" (german) Hi! As i came back from my holiday my sister showed me this email she got: < START > Received: from [172.20.1.104] (helo=mailgate6.cinetic.de) by mx06.web.de with esmtp (WEB.DE(Exim) 4.75 #2) id 17hHVy-0004sp-01 for grundwasser16@web.de; Wed, 21 Aug 2002 00:30:18 +0200 Received: from hotmail.com (f176.law11.hotmail.com [64.4.17.176]) by mailgate6.cinetic.de (8.11.2/8.11.2/WEBDE Linux 8.11.0-0.2) with ESMTP id g7KLA2w06138 for <grundwasser16@web.de>; Tue, 20 Aug 2002 23:10:02 +0200 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Tue, 20 Aug 2002 14:09:58 -0700 Received: from 217.233.67.236 by lw11fd.law11.hotmail.msn.com with HTTP; Tue, 20 Aug 2002 21:09:58 GMT X-Originating-IP: [217.233.67.236] From: "R K" <jetli63@hotmail.com> To: grundwasser16@web.de Subject: Hallo Sissy... !!!! Date: Tue, 20 Aug 2002 23:09:58 +0200 Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1; format=flowed Message-ID: <F176eBj0Ny4jmF24OLO00012e5f@hotmail.com> X-OriginalArrivalTime: 20 Aug 2002 21:09:58.0686 (UTC) FILETIME=[F0C583E0:01C2488D] Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by mailgate6.cinetic.de id g7KLA2w06138 Na, wie geht´s dem Freund??? Na ja, egal, mit 17 ist ja noch alles offen, und vielleicht findet sich beim chatten ja was richtiges. Oder ist bei Euch in Lorch nix los?? Kann ja mal anrufen bei Dir: 071xx/9155xx Was machst Du so, wenn du mal nicht im Internet surfst und deine Spuren hinterlässt??? Wie sieht´s mit der Mittleren Reife aus? Alles gut überstanden?? Na ja, wer immer "Wer wird Millionär" schaut, kann ja gar nicht schlecht sein... grins... Du solltest Dich mal ERNSTHAFT mit Mario unterhalten, schliesslich sollte er ja "vom Fach" sein... Vielleicht weiss er ja, WOHER ICH ALL DEINE DATEN HABE, OBWOHL ICH HUNDERTE KM ENTFERNT BIN!!!!!! THINK SAFE!!! KEEP YOUR PC SAFE!!!! Greetzzzz vom HACKerKinG PS ich habe weder mit dir jemals gechatted noch kenne ich dich in irgendeiner form ... UND TROZDEM IST NICHTS FIKTIV! Bedenke BIG BROTHER IS WATCHING YOU!! Ask for more!!!!! ... and youll get the answer _________________________________________________________________ Mit MSN Fotos können Sie kinderleicht Ihre Fotos ausdrucken und Freunden zur Verfügung stellen: http://photos.msn.de </jump.htm?goto=http://photos.msn.de> < STOP > I am running 2 PCs, SuSE7.3 (PDC, Web, Mail, edonkey, ircd. Not updated for 23days) and SuSE7.2 (SuSEfirewall2. not updated for 13days). I could not find anything interesing in my logfiles. Seems like he never touched my server, but if he really got in i would not find the tracks anyway, her will have removed them. But i doubt that he is a professional. His name does look like a script kiddy, his mailaddress at hotmail is a sign for a scriptkiddy, too. Not logs from a network scanner, nothing. I hope that he just got in contact with the w2k client, not with my servers. The w2k SP2 workstation where my sister works on was not infected by a trojan (Scanned by norton anti virus 2002). What do i do next, how can i dected my security hole? I want to find the hole, before i install my Servers again. Any tip, hint, would be great! Thanks! Mario Ohnewald p.s. I hope i have told you everything you have to know. -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help@suse.com Security-related bug reports go to security@suse.de, not here