topic Re: Utility like PCAnywhere in Operating System - HP-UX

Utility like PCAnywhere

sdip — Mon, 11 Oct 2004 21:48:53 GMT

Dear gurus -

Do you know any utility available in HP-UX which can used like PC ANywhere software. Actually I beleive somebody is hacking our system. I would like to know how they did the same.

Re: Utility like PCAnywhere

Sridhar Bhaskarla — Mon, 11 Oct 2004 22:03:54 GMT

Hi Sdip,

There is SharedX but acts a bit like PC Anywhere but one has to allow them to use ShareX and you will see the such windows as "Shared".

Check for last successful logins, IP addresses where the logins are from etc. using 'last' command. You can also check the history of root and the users that you think are compromised.

-Sri

Re: Utility like PCAnywhere

Steven E. Protter — Mon, 11 Oct 2004 22:07:13 GMT

A utility like pcanywhere won't tell you a thing. If you have xfs set to enable in /etc/rc.config.d/xfs file you can use X emulation software to have an X desktop.

In there you could do the following:

tail -f /var/adm/syslog/syslog.log and track logins.

To look for evidence of hacking you can carefully monitor the wtmp and btmp files or copy them off regulalry with a date stamp if the hacker is cleaning up after him/herself.

Go through /etc/passwd and see if the hacker has set up an account for him/herself. Check for copies of ksh or sh that have suid set therefore letting the user become root.

A really good product to get is commerical tripwire. If the hacker is messing with log files or configuration files to cover his/her tracks tripwire will spot it and let you know what ws done and how.

http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B6849AA

Will harden your system against hackers.

It requires:
http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=PERL

HIDS will help spot hackers as well:

http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=J5083AA

SEP

Re: Utility like PCAnywhere

Yogeeraj_1 — Tue, 12 Oct 2004 00:06:55 GMT

hi,

there is also the VNC software that can be used (only if the server processes are running).

You may wish to install an Intrusion Prevention software so that this do not recur in the future..

good luck!
regards
Yogeeraj

Re: Utility like PCAnywhere

Jim Allan — Wed, 13 Oct 2004 03:44:33 GMT

if a hacker has breached your system, i doubt they will be using a graphical client to do so..

as someone said previously, monitor syslog for logins, and use the command 'last' to see what users have been logging in and for how long (wtmp)

check for any major logs that have been 0-byted (/var/adm/syslog/syslog.log)