EvilDragon said:
yep, got a nice exploit on the server.
Don't worry, nothing's lost, I keep a lot of backups.
Out of curiosity - what OS did you use on that server?
Did you have there any sensitive data, like emails of people subscribed to newsletter, or bank info?
PS: I'm using rsnapshot for making backups, it works great.
It was OpenSuSE 10.3, with latest security patches.
There a few secure datas there (nothing banking related) but those are encrypted.
Also (I had a long night yesterday checking what happened and what they did) they didn't gain any root access (my server isn't THAT insecure
)
They managed to run a tool as WWWRUN (apache user) which connected to an IRC server (with port 1234) and allowed them to send spam mails via apache.
The apache user can't do much more and can't access any databases or stuff like that. He also can't read / write any webfiles without the passwords of the users, so they didn't have any access to databases, mails or any other stuff like that.
Also, I have RKHunter which makes hashes of all important files (like passwd, etc.) and nothing has changed. They clearly couldn't do anything than spam out eMails... which is annoying enough though.
