PDA

View Full Version : SLiM server hacked?



Mark Palmberg
2005-02-06, 18:08
I woke up this morning and see that all of my track titles and my
three playlists have been renamed to:

search google & find yr player.. from You need a firewall by QUICK

I did a whois on the player that appears to be tied to the playlists, and it's:

Ameritech Electronic Commerce SBCIS-AMER-100902 (NET-68-72-0-0-1)
68.72.0.0 - 68.79.255.255
PPPoX Pool-Rback2 mdsnwi SBC068073106000030221 (NET-68-73-106-0-1)
68.73.106.0 - 68.73.107.255

Anyone else seeing anything like this? I've never encountered it
before, and I'm not sure how to fix it. All my source .mp3s appear to
still be tagged correctly, but somehow the slim server is reporting a
different track name (though artist and album are unchanged).

TIA.

Jack Coates
2005-02-06, 19:33
> I woke up this morning and see that all of my track titles and my
> three playlists have been renamed to:
>
> search google & find yr player.. from You need a firewall by QUICK
>
> I did a whois on the player that appears to be tied to the playlists, and
> it's:
>
> Ameritech Electronic Commerce SBCIS-AMER-100902 (NET-68-72-0-0-1)
> 68.72.0.0 - 68.79.255.255
> PPPoX Pool-Rback2 mdsnwi SBC068073106000030221 (NET-68-73-106-0-1)
> 68.73.106.0 - 68.73.107.255
>
> Anyone else seeing anything like this? I've never encountered it
> before, and I'm not sure how to fix it. All my source .mp3s appear to
> still be tagged correctly, but somehow the slim server is reporting a
> different track name (though artist and album are unchanged).
>
> TIA.

that's an ugly one... there aren't any known exploits, so my first
question is if you have done the following:

a) implemented a firewall between you and the Internet

b) turned on slimserver's password protection.

In other words, have you done the basics?

--
Jack At Monkeynoodle.Org: It's A Scientific Venture...
"Believe what you're told; there'd be chaos if everyone thought for
themselves." -- Top Dog hotdog stand, Berkeley, CA