am I being hacked

[badcompany]

Apr 23 07:29:30 syslog: always->ssh=eth3 OUT= MAC=7c:4c:a5:46:04:2e:a0:f3:e4:9f:98:04:08:00 SRC=198.20.99.130 DST=123.**.95.**2 LEN=40 TOS=0x00 PREC=0x00 TTL=119 ID=3245 PROTO=TCP SPT=11413 DPT=2323 WINDOW=15066 RES=0x00

What does this mean it's in my router log was someone accessing my network?

 

[linktoinsanity]

Check your computers' MAC addresses and see if they match that one?

Other than that, not necessarily being hacked no.

 

[TwsT]

yes I would format and re-install everything immediately to be safe.........






lol

more serious note would be to identify al the mac addresses you have in your house (phones laptops nas etc) if it's not one of those then it would appear something is accessing your router yes

 

[KIA]

No.

It's an automated scan by Shodan.

https://whois.domaintools.com/198.20.99.130
http://www.shodanhq.com/

 

[badcompany]

whats shodan? I was curious as house was empty at the time.


edit


oh i see what it does, not nice then.

 

[TheBigCheese]

whats shodan?

 

[badcompany]

nothing to worry about then? I just have my pi exposed so I can ssh in and logon to over pc's as required.

 

[KIA]

nothing to worry about then? I just have my pi exposed so I can ssh in and logon to over pc's as required.

Nothing to worry about if you have locked down sshd.

http://www.rackaid.com/blog/how-to-harden-or-secure-ssh-for-improved-security/

Key priorities:

• Disable root login
• Use public key authentication
• Disable password authentication

 

[badcompany]

Cool thanks will check I did do some hardening of initial install but it was a while ago. I only use for a wolrelay and other PC not been turned on for a couple of days.