Linked below are details about a new outbreak of hijacked linux web
servers that dispense malware.
http://blog.unmaskparasites.com/2009/09/11/dynamic-dns-and-botnet-of-zombie-web-servers/
I would highly recommend that you use nmap to scan all your Linux
webservers that are connected to the Internet to see if they are
listening on port 8080.
The best I can tell, there are no articles concerning how these guys
installed nginx or what is contained on a machine that has been
compromised. But the best way to tell is to see if you are listening on
port 8080 (if you are not supposed to be listening there). 8080 is a
common port for java apps to be running on, so listening on 8080 is not
always necessarily bad.
Thanks,
Johnny Hughes
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 253 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.centos.org/pipermail/centos/attachments/20090912/dc6df86b/attachment.sig>
