From owner-freebsd-security@FreeBSD.ORG Thu Feb 26 09:37:24 2015 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id A091E3FD; Thu, 26 Feb 2015 09:37:24 +0000 (UTC) Received: from mx2.nkhosting.net (mx2.nkhosting.net [109.75.177.32]) by mx1.freebsd.org (Postfix) with ESMTP id 58E2F7ED; Thu, 26 Feb 2015 09:37:23 +0000 (UTC) Received: from mx2filter1.nkhosting.net (unknown [109.75.177.32]) by mx2.nkhosting.net (Postfix) with ESMTP id D52122D64123; Thu, 26 Feb 2015 10:37:21 +0100 (CET) X-Virus-Scanned: amavisd-new at mx2.nkhosting.net X-Spam-Flag: NO X-Spam-Score: -2.9 X-Spam-Level: X-Spam-Status: No, score=-2.9 tagged_above=-999 required=6.2 tests=[ALL_TRUSTED=-1, BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mx2.nkhosting.net ([109.75.177.32]) by mx2filter1.nkhosting.net (mx2filter1.nkhosting.net [109.75.177.32]) (amavisd-new, port 10024) with ESMTP id E3eHD8mLotFE; Thu, 26 Feb 2015 10:37:15 +0100 (CET) Received: from imac.t19.nkhosting.net (g228132172.adsl.alicedsl.de [92.228.132.172]) by mx2.nkhosting.net (Postfix) with ESMTPSA id DDFF32D64143; Thu, 26 Feb 2015 10:37:15 +0100 (CET) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\)) Subject: Re: has my 10.1-RELEASE system been compromised From: Philip Jocks In-Reply-To: <20150226082400.GE29176@in-addr.com> Date: Thu, 26 Feb 2015 10:37:15 +0100 Content-Transfer-Encoding: quoted-printable Message-Id: References: <864mq9zsmm.fsf@gly.ftfl.ca> <54EE2A19.7050108@FreeBSD.org> <86vbipycyc.fsf@gly.ftfl.ca> <20150226082400.GE29176@in-addr.com> To: Gary Palmer X-Mailer: Apple Mail (2.1510) Cc: Joseph Mingrone , freebsd-security@freebsd.org, Jung-uk Kim X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Feb 2015 09:37:24 -0000 Am 26.02.2015 um 09:24 schrieb Gary Palmer : > On Wed, Feb 25, 2015 at 04:04:59PM -0400, Joseph Mingrone wrote: >> Jung-uk Kim writes: >>=20 >>> On 02/25/2015 14:41, Joseph Mingrone wrote: >>>> This morning when I arrived at work I had this email from my=20 >>>> university's IT department (via email.it) informing me that my host >>>> was infected and spreading a worm. >>>>=20 >>>> "Based on the logs fingerprints seems that your server is infected >>>> by the following worm: Net-Worm.PHP.Mongiko.a" >>>>=20 >>>> my ip here - - [23/Feb/2015:14:53:37 +0100] "POST=20 >>>> /?cmd=3Dinfo&key=3Df8184c819717b6815a8b8037e91c59ef&ip=3D212.97.34.7 >>>> HTTP/1.1" 200 429 "-" "Net- Worm.PHP.Mongiko.a" >>>>=20 >>>> Despite the surprising name, I don't see any evidence that it's >>>> related to php. I did remove php, because I don't really need it. >>>> I've included my /etc/rc.conf below. pkg audit doesn't show any=20 >>>> vulnerabilities. Searching for Worm.PHP.Mongiko doesn't show >>>> much. I've run chkrootkit, netstat/sockstat and I don't see >>>> anything suspicious and I plan to finally put some reasonable >>>> firewall rules on this host. >>>>=20 >>>> Do you have any suggestions? Should I include any other >>>> information here? >>> ... >>>=20 >>> I found this: >>>=20 >>> = http://security.stackexchange.com/questions/82273/what-is-net-worm-php-mon= giko-trying-to-do >>>=20 >>> Jung-uk Kim >>=20 >> Yeah, I saw that as well. I wouldn't be concerned if this was = hitting >> my web server, but the key difference here is that my IP is the >> apparently the source in this case. >=20 > Did you see the part of the link that said the alert was likely a = scam? > Sounds to me like the people who cold call people and tell them their = Windows > computer is broken have moved on. the thing about the scam was posted by a friend after Joseph's post to = the freebsd-security mailing list so people on stackexchange will be = warned as well. Philip