[Resolved]01micko.com compromised

Message

James C · #31 Post by **James C** » Sun 15 Jun 2014, 21:15

james@mx1:~
$ ping -c5 01micko.com 
PING 01micko.com (27.124.113.33) 56(84) bytes of data.
64 bytes from server-x-r6.ipv4.au.syrahost.com (27.124.113.33): icmp_req=1 ttl=42 time=313 ms
64 bytes from server-x-r6.ipv4.au.syrahost.com (27.124.113.33): icmp_req=2 ttl=42 time=314 ms
64 bytes from server-x-r6.ipv4.au.syrahost.com (27.124.113.33): icmp_req=3 ttl=42 time=321 ms
64 bytes from server-x-r6.ipv4.au.syrahost.com (27.124.113.33): icmp_req=4 ttl=42 time=321 ms
64 bytes from server-x-r6.ipv4.au.syrahost.com (27.124.113.33): icmp_req=5 ttl=42 time=318 ms

--- 01micko.com ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4004ms
rtt min/avg/max/mdev = 313.394/318.055/321.856/3.529 ms
james@mx1:~

8-bit · #32 Post by **8-bit** » Sun 15 Jun 2014, 22:51

This ping request is from southern Oregon, USA.

Code: Select all

# ping -c5 01micko.com 
PING 01micko.com (27.124.113.33): 56 data bytes
64 bytes from 27.124.113.33: seq=0 ttl=50 time=241.197 ms
64 bytes from 27.124.113.33: seq=1 ttl=50 time=240.690 ms
64 bytes from 27.124.113.33: seq=2 ttl=50 time=239.967 ms
64 bytes from 27.124.113.33: seq=3 ttl=50 time=241.003 ms
64 bytes from 27.124.113.33: seq=4 ttl=50 time=240.462 ms

--- 01micko.com ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 239.967/240.663/241.197 ms

It seems to read about the same as others have got.
But the only information it gives is that the domain exists and gives the IP address found if I am correct in this.

Karl Godt · #33 Post by **Karl Godt** » Sun 15 Jun 2014, 23:46

01micko wrote:My host is allocated 27.124.111.0 to 27.124.118.255

My actual IP address is in the range 203.170.80.0 to 203.170.87.255. I can log on to that one with FTP. (Also allocated to my host)

Ping this domain; computerfairy.net, browse the site if you wish, it's a drupal install on my host, same root directory as 01micko.com. I own the domain. That's my real IP address.

Karl, see if you can log in through a browser once you have my real IP. The root folder is public_html, however you may only be able to get to public_html/KRG with your permissions.

In the browser bar
Code: Select all
ftp://$REAL_IP_ADDRESS/public_html/
Happy hunting.

By the way, I've renamed my word press folder and removed any js from my index.html. I have removed a couple of perl scripts too. I don't expect to see an improvement based on the above info.

This is what I get using firefox and gftp :

Looking up ftp.01micko.com
Trying 01micko.com:21
Connected to 01micko.com:21
220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
220-You are user number 1 of 50 allowed.
220-Local time is now 07:35. Server port: 21.
220-IPv6 connections are also welcome on this server.
220 You will be disconnected after 15 minutes of inactivity.
USER KRG@01micko.com
331 User KRG@01micko.com OK. Password required
PASS xxxx
530 Login authentication failed
Disconnecting from site ftp.01micko.com

Micko, you gave me such a great password with a ']' in it .
Had already tried using
wget --ftp-user=USER --ftp-password=PASS

Code: Select all

wget --ftp-user=KRG@01micko.com --ftp-password='VERY]GOODpassword' ftp://01micko.com
--01:41:27--  ftp://01micko.com/
           => `.listing'
Resolving 01micko.com... 27.124.113.33
Connecting to 01micko.com|27.124.113.33|:21... connected.
Logging in as KRG@01micko.com ... 
Login incorrect.

So I had thought, that you had changed all passwords incl. mine or even removed it from the TOP SECRET hidden password file /var/.shalow ...

( Linux is very secure ..

)

01micko · #34 Post by **01micko** » Mon 16 Jun 2014, 00:03

Karl,

You are responsible for your password and you can change it to whatever you want

Try logging in with the IP. The real IP is 203.170.81.33. You should be able to just fine in gftp or filezilla. It works in browser too, ftp only.

Meanwhile I redirected my home page to micko.computerfairy.net and reinstated the javascript. If that is the cause (which I think not) then that address will succumb to the predator as well.

l0wt3ch · #35 Post by **l0wt3ch** » Mon 16 Jun 2014, 00:58

Sorry to hear about this!

Hopefully it all gets sorted out without very much trouble.

musher0 · #36 Post by **musher0** » Mon 16 Jun 2014, 01:06

gcmartin wrote:To begin to see the DNS issue I speak of, do this from a terminal Window:
Code: Select all
# ping -c 5 01micko.com
PING 01micko.com (27.124.113.33): 56 data bytes
64 bytes from 27.124.113.33: seq=1 ttl=44 time=275.179 ms
64 bytes from 27.124.113.33: seq=2 ttl=43 time=278.243 ms
64 bytes from 27.124.113.33: seq=3 ttl=43 time=273.757 ms
64 bytes from 27.124.113.33: seq=4 ttl=43 time=274.601 ms

--- 01micko.com ping statistics ---
5 packets transmitted, 4 packets received, 20% packet loss
round-trip min/avg/max = 273.757/275.445/278.243 ms
If this is done from every continent we begin to see what the DNS resolutions are telling your browsers. The above is from a North-Western Hemisphere PC.

What continent and what does your resolution show? This helps in that we can get a worldly picture of what the browsers are being told. And, to how far the problem has cascaded.

Hello, gcmartin.

These are the results from my position:

ping -c 5 01micko.com
PING 01micko.com (203.170.81.33): 56 data bytes
64 bytes from 203.170.81.33: seq=0 ttl=49 time=307.073 ms
64 bytes from 203.170.81.33: seq=1 ttl=49 time=300.629 ms
64 bytes from 203.170.81.33: seq=2 ttl=49 time=301.088 ms
64 bytes from 203.170.81.33: seq=3 ttl=49 time=302.288 ms
64 bytes from 203.170.81.33: seq=4 ttl=49 time=281.223 ms

--- 01micko.com ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 281.223/298.460/307.073 ms

I hope this helps. BFN.

Chris

01micko · #37 Post by **01micko** » Mon 16 Jun 2014, 01:23

musher0 wrote:ping -c 5 01micko.com
PING 01micko.com (203.170.81.33): 56 data bytes
64 bytes from 203.170.81.33: seq=0 ttl=49 time=307.073 ms

Hey Musher0, that is the right address. Did 01micko.com work in a browser?

I just got word back from the host:

Paul A (Customer Care Agent)

Jun 16 08:50 AM

Hello Michael,

Thank you for your email.

We do apologize for the inconvenience, Michael. Upon checking into the account and the settings, we found out that there were 2 hosting account on different server and unfortunately the inactive one was on the server with higher dns priority. We have already shut down that account and now there is only one hosting account. Please do consider waiting within 2 to 4 hours since changes have been applied and there is a downtime for 2 to 4 hours. After that it will be up and running.

Thank you
Paul A

Crazy Domains
Customer Support

www.CrazyDomains.com

Domains, Hosting & more...
Domain Names | Web Hosting | Email Hosting | Build your Site | Promote your Site

DISCLAIMER: This e-mail and/or attachments are confidential and may also be privileged. If you are not the named recipient, please notify the sender immediately and do not disclose the contents to other persons or use it for any purpose or store or copy the information in any medium. Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of Crazy Domains.

See what happens after 3:30 my time I guess.

greengeek · #38 Post by **greengeek** » Mon 16 Jun 2014, 01:39

I couldnt get the -c option to work - probably because I am on Windows at the moment, so I diid the following:

Code: Select all

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

H:\>ping -c 5 01micko.com
Bad option -c.


Usage: ping [-t] [-a] [-n count] [-l size] [-f] [-i TTL] [-v TOS]
            [-r count] [-s count] [[-j host-list] | [-k host-list]]
            [-w timeout] target_name

Options:
    -t             Ping the specified host until stopped.
                   To see statistics and continue - type Control-Break;
                   To stop - type Control-C.
    -a             Resolve addresses to hostnames.
    -n count       Number of echo requests to send.
    -l size        Send buffer size.
    -f             Set Don't Fragment flag in packet.
    -i TTL         Time To Live.
    -v TOS         Type Of Service.
    -r count       Record route for count hops.
    -s count       Timestamp for count hops.
    -j host-list   Loose source route along host-list.
    -k host-list   Strict source route along host-list.
    -w timeout     Timeout in milliseconds to wait for each reply.

H:\>ping -n 5 01micko.com

Pinging 01micko.com [203.170.81.33] with 32 bytes of data:

Reply from 203.170.81.33: bytes=32 time=426ms TTL=44
Reply from 203.170.81.33: bytes=32 time=80ms TTL=44
Reply from 203.170.81.33: bytes=32 time=80ms TTL=44
Reply from 203.170.81.33: bytes=32 time=80ms TTL=44
Reply from 203.170.81.33: bytes=32 time=81ms TTL=44

Ping statistics for 203.170.81.33:
    Packets: Sent = 5, Received = 5, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 80ms, Maximum = 426ms, Average = 149ms

H:\>

http://www.01micko.com in the browser gives me your normal site so all good here at the moment.

01micko · #39 Post by **01micko** » Mon 16 Jun 2014, 01:52

Thanks Greengeek, looks like it's fixed.. but Google is still crawling the Chinese site - lol.. probably pissing them off too.

Too early to call "resolved" but looks like it is.

musher0 · #40 Post by **musher0** » Mon 16 Jun 2014, 02:27

Hi, micko.

Is this how it's supposed to look?

musher0

8-bit · #41 Post by **8-bit** » Mon 16 Jun 2014, 02:32

I just tried your site and the Chinese stuff no longer is there!
So it looks like it may be resolved now.

01micko · #42 Post by **01micko** » Mon 16 Jun 2014, 02:44

Musher0 - yep. That's how it looks when adblocker or sc0ttmans Pup-Advert-Blocker is running

8-bit - I think it is but my sub-domains aren't working yet. I've marked "resolved" but it's not fully resolved until slacko.01micko.com gets back up. It is accessible at 01micko.com/slacko57.

technosaurus · #43 Post by **technosaurus** » Mon 16 Jun 2014, 05:36

speaking of advert blocker... it should be patched to use 0.0.0.0 instead of 127.0.0.1 so that proxy servers can use it. They are quite handy if you use multiple browsers so that caching is done in 1 place ...polipo is a nice one I discovered when building hv3 a while back ... its small and use multiple techniques to speed up browsing.

musher0 · #44 Post by **musher0** » Mon 16 Jun 2014, 10:38

01micko wrote:Musher0 - yep. That's how it looks when adblocker or sc0ttmans Pup-Advert-Blocker is running
(...)

Hi, micko.

None of the above!

The name of the opera extension I use for ad-blocking is called
"ghostery". (It does a lot more than that, too.)

Also a good recent "hosts" file in /etc.

Glad to see that your site is slowly getting back to normal, sort of.

BFN.

Chris

8-bit · #45 Post by **8-bit** » Tue 17 Jun 2014, 05:46

01micko,
I see what you mean about the sub-sections of your site being slow coming back. I tried using some of the links in your threads on the forum that are supposed to access areas of your web site and still get a 404 error a lot.
This is not good in that someone new that was browsing the forum and wanted to check out more about some of your ISOs or download one would get a 404 error and possibly assume that the version of Puppy no longer existed.

Of course one could expand this to the Additional Software section of the forum that had links to bigger files that do not work now with the lower file size restriction on the forum and file sharing sites that only keep a file available for a limited time.

01micko · #46 Post by **01micko** » Tue 17 Jun 2014, 07:37

8-bit wrote:01micko,
I see what you mean about the sub-sections of your site being slow coming back. I tried using some of the links in your threads on the forum that are supposed to access areas of your web site and still get a 404 error a lot.
This is not good in that someone new that was browsing the forum and wanted to check out more about some of your ISOs or download one would get a 404 error and possibly assume that the version of Puppy no longer existed.

Of course one could expand this to the Additional Software section of the forum that had links to bigger files that do not work now with the lower file size restriction on the forum and file sharing sites that only keep a file available for a limited time.

Yep, a real pain in the a*se. My host is basically useless. I'm raising another ticket with them but still no response. I'll edit the main 5.7 slacko post and post the direct address.

cheers

EDIT: my sub-domains are up now!

(old)Puppy Linux Discussion Forum

(old)Puppy Linux Discussion Forum

[Resolved]01micko.com compromised

Re: Share what your PC sees relating 01Micko's problem, to help