Use NMAP and run a port scan on the machine in question. There may be other ports in use that should not be as well. Check your server logs for sure; especially the security audits. Chances are if someone pwned your machine they are keeping up with cleaning out the logs..sometimes they don't though and evidence is left behind.
Also use WireShark and sniff the network traffic coming from that machine. If there is a lot of SSH traffic coming from it when you aren't using it then it's either a bot or a hacker. Either are just as bad IMHO.
You can attack SSH implementations trying to force buffer overflows that allow an attacker to execute code on the target machine. I'm not up on the latest SSH exploits but if you are using SSH on your machines I would suggest you get up to speed quickly and patch yours. Anti-root kit software would be a good purchase at this point. I think AVG has something in that arena.
If your machine is accessible from the internet via SSH or Telnet , and it happened to be hacked, judging from the call you received from your ISP your SSH or Telnet was exploited. Once (speculation) they had yours they started looking for others to exploit....It's a grand theory but I have seen it firsthand before...
Main Topics
Browse All Topics
by: ISoulPosted on 2009-10-29 at 13:47:52ID: 25698093
One option for you is to enable logging on your DD-WRT router and analyze the data afterwards to see if you truly do have a lot of outgoing traffic for the SSH and Telnet ports originating from a machine on your internal network.
See this page for more info: http://www.dslreports.com/