Back in the day, I ran a Mandrake linux box from home on an old laptop (student days, wahey!) which used to host my site and emails. One fine day, I realised that it was getting a little sluggish in terms of performance.
On a closer look, running "top" showed a process called "z" that was eating the process up. Yup, only called "z". It turns out that someone was running a script looking for awstats vulnerabilities, managed to find my installation and installed "z". "z" opened a back door and a small file management utility. Thankfully, nothing was deleted. I think the intruder couldn't get out of the www-data account. I just reinstalled the whole thing from scratch.
The worst part of it was that the vulnerability (and the solution) had been out in the open for months!
Lessons:
1. Always keep an up to date system
2. Subscribe to all announcement/security mailing lists for sites/packages that are deployed to the public
On a closer look, running "top" showed a process called "z" that was eating the process up. Yup, only called "z". It turns out that someone was running a script looking for awstats vulnerabilities, managed to find my installation and installed "z". "z" opened a back door and a small file management utility. Thankfully, nothing was deleted. I think the intruder couldn't get out of the www-data account. I just reinstalled the whole thing from scratch.
The worst part of it was that the vulnerability (and the solution) had been out in the open for months!
Lessons:
1. Always keep an up to date system
2. Subscribe to all announcement/security mailing lists for sites/packages that are deployed to the public