[amsat-bb] Re: UK AMsat website been hacked!

[John Heaton]

On Sun, 2007-12-16 at 08:33 -0800, wa6fwf wrote:
>     it looks fine here, maybe they have already fixed it or if you check
> again and it still looks hacked your pc may have been compromised
> and your being redirected to different sites...

It had been hacked, along with a few other virtual servers on the same
system.  I restored them all from a backup and did a bit of digging
around. So far found 1 ircbot and a world-writeable directory.  The
index.html etc in almost every directory had been got at, even some not
in the web directories all of which had a time stamp of 0432-0436 this
morning.  What med me more suspicious was a reboot at 10:50 yesterday
morning, but suddenly remembered that the power was off yesterday around
that time and a few other systems in the next office also had a reboot.

Bye for now, John