Re: boot -s - can i detect intruder

From: Nikolay Kanchev (niki_at_amk-drives.bg)
Date: 09/16/03

  • Next message: GomoR: "Re: Fwd: Re: [Full-Disclosure] new ssh exploit?" 
    To: <freebsd-security@freebsd.org>
Date: Tue, 16 Sep 2003 13:38:11 +0100

    Thanks all

    I know that if someone have physical access to my servers can penetrade into
    them. And this is a reason to test this guys with this fake server. Some of
    them thinks that they are "hackers" and try to crack passwords, install
    backdors and etc. For now not very successfully ;-)

    I will try to mod the kernel, hardware keylogers are expensive for me.

    Test complete after one week and I'm not sure that I have time to mod
    kernel, but now I find one free security camera and will install it in the
    room with box and capture guys activity, that I will have a proof :-)

    Best Regards
    Nikolay Kanchev

    ----- Original Message -----
    From: "G Hasse" <gh@raditex.se>
    To: "Jason Stone" <freebsd-security@dfmm.org>
    Cc: "Nikolay Kanchev" <niki@amk-drives.bg>
    Sent: Tuesday, September 16, 2003 1:16 PM
    Subject: Re: boot -s - can i detect intruder

    On Tue, 16 Sep 2003, Jason Stone wrote:

    > -----BEGIN PGP SIGNED MESSAGE-----
    > Hash: SHA1
    >
    >
    > > Several people have physical access to my FreeBSD box and I have the
    feeling
    > > that somebody try to get access with boot -s options . Can I log
    activity
    > > after boot -s option (change user password, install software and etc.).
    > > I use boot -s and change user password, but after reboot i can't find
    this
    > > atcivity in log files.
    > > The BSD box is shutdown and run again many time at day.
    >
    > Well, there might be some stuff you can do - maybe you can mod the kernel
    > to log every execve(2) to a serial port or a line printer - maybe you
    > could even log over the net or something.
    >
    > I've seen some patches to bash floating around that make logging of
    > command history mandatory - this is a pretty useless approach if your
    > attacker is at all sophisticated, but if the attacker is really clueless,
    > it might help. Of course in this case, writing to disk will be
    > problematic, because when you start up, the filesystem will be mounted
    > read-only, and you can't necesarily count on any particular filesystem
    > ever being read-write, and if a filesystem does become read-write, you'll
    > have to take advantage of it quickly, because you don't know how long it's
    > going to stay read-write.
    >
    > You could get a hardware keystroke logger - thinkgeek.com has one, and
    > another company I forget the name of - find the tinfoilhat linux webpage,
    > and start following links. If the attacker doesn't think to look for
    > something like this, and if you have the money to spend, this might be the
    > easiest approach for you.

    Note that on line 429 in init_main.c (FreeBSD 4.8) there is a list
    of shells to run. Normaly /sbin/init is run and in single user mode
    the user could select a shell of his own. (normaly sh). In that case
    it is possible to replase the normal sh and have a shell that loggs
    every command to a line-printer.

    Göran Hasse

    ----------------------------------------------------------------
    Göran Hasse email: gh@raditex.se Tel: 08-6949270
    Raditex AB http://www.raditex.se Fax: 08-4420570
    Sickla Alle 7, 1tr Mob: 070-5530148
    131 34 NACKA, SWEDEN

    _______________________________________________
    freebsd-security@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-security
    To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"

  • Next message: GomoR: "Re: Fwd: Re: [Full-Disclosure] new ssh exploit?"

    Relevant Pages

    • Re: (no subject)
      ... > point out though is if a hacker were to spoof his IP address and do a port ... all traffic coming from the IP address of the port scan, the attacker ... servers, which will cause your machine to blackhole them and thereby ... blackhole popular websites like google which the user might use. ...
      (FreeBSD-Security)
    • Re: Pen-test pricing
      ... The number of servers, locations, firewalls, DMZs and other ... Class 2 Attacker ... auf der CeBIT in Hannover! ... In der CEFIS Halle 7 Stand C22/14 informieren Sie unsere Berater ...
      (Pen-Test)
    • Re: Do I have to set another password in the CMOS setting to enhance the security of OS?
      ... one of the "ten immutable laws" is that physical access beats ... Even using encryption is a kind of a gamble, ... useless to me as an attacker. ... Software Design Engineer, Internet Information Server ...
      (microsoft.public.security)
    • Re: Question re: load balancers as a security device
      ... managed servers at a hosting facility - the servers, ... load balancers are exclusive to our use but managed by the ISP. ... There are exploits "in the wild" where a shell is created and the control connection for it is set up *outbound* to the attacker. ... There are also exploits "in the wild" where individual command shell commands can be run, and the results returned in the http reply. ...
      (Pen-Test)
    • Re: (no subject)
      ... but if you have a fascist response to port scans which blackholes ... > all traffic coming from the IP address of the port scan, the attacker ... > servers, which will cause your machine to blackhole them and thereby ... > blackhole popular websites like google which the user might use. ...
      (FreeBSD-Security)