I think someone gained access to root

**Daiver** · 02-12-2006, 09:58 AM

Help!

I just went into my root account using Putty and the last login was from someone in Pakistan, which is definetely NOT me or the JPC staff.

That's him right there.

Where can I find a log of what he did? What can I do to make sure he doesn't get back in?

**Frank Broughton** · 02-12-2006, 11:07 AM

Are you on a VPS or a shared account?

**Ron** · 02-12-2006, 02:57 PM

Off hours tech support is from Pakistan

**Daiver** · 02-13-2006, 12:54 AM

I'm on a VPS.

Are you serious about pakistani tech support, Ron?

**Vin DSL** · 02-13-2006, 03:27 AM

A guy named Fred Al-Misri answered my ticket the other night, but I think he's in Texass. His sig said, "Ya'll come back now, hear?"

Correction: I just looked it up. It said, "Ya'll come on back, dear!" Tech Support is probably in Brokeback Mtn or Sugar Land, TX...

**the_ancient** · 02-13-2006, 03:35 AM

Originally Posted by Ron

Off hours tech support is from Pakistan

Jag posted over a WHT awhile back (which may have changed) they they use all North American Support, he said they have one guy FROM pakistan or india or one of them but he lives in Canada....

Like I said that could have changed

**Vin DSL** · 02-13-2006, 03:51 AM

Originally Posted by the_ancient

Canada...

That explains it!

**Ron** · 02-13-2006, 09:02 AM

Well, I'm not sure, but when people visit my site from a ticket, I think the IPs have been from .pk, recently.

**Rye Seronie Oh** · 02-13-2006, 09:34 PM

I thought that the after hours tech support was from India.. They use bobcares.com right? That's what I've read on the forums before.

**Ron** · 02-13-2006, 11:38 PM

I'm pretty sure that after hours support comes from, in part, Pakistan. This was a big change a little while back when Jag moved to further improve off hours support.

**jason** · 02-13-2006, 11:40 PM

Originally Posted by Rye Seronie Oh

I thought that the after hours tech support was from India.. They use bobcares.com right? That's what I've read on the forums before.

Masood is in Canada, but I don't know where the after-hours support is located. I know that BbCares was originally supposed to provide support to HostGUI, so I assume they used them in the past, but I don't know about now. I try to open most of my tickets during normal business hours, but I know that several of my after hours tickets have been answered by people with Inian (or Pakistani perhaps) sounding names.

--Jason

**Spathiphyllum** · 02-14-2006, 08:54 AM

I'll second Ron. When my site needs investigating, I have to tweak my .htaccess files to allow access from .pk, otherwise off-hour support cannot debug properly.

**Gwaihir** · 02-14-2006, 04:36 PM

Masood is in Canada? Doesn't his sig actually say "at the jag servers" or something like that? I allways assumed him to be physically close to the systems.