Re: IIS web server hacked..any tips?

Valdis.Kletnieks_at_vt.edu
Date: 12/16/04

  • Next message: K.M. Jeary: "Re: IIS web server hacked..any tips?" 
    To: cta@hcsin.net
Date: Thu, 16 Dec 2004 12:08:50 -0500

    On Wed, 15 Dec 2004 19:44:34 EST, "cta@hcsin.net" said:

    > Just to add some sage advice… if you really want to ensure that the
    > contents of a suspected compromised machine's virtual memory, as well as
    > its hard drive are intact then I would NOT "pull the plug" i.e.,
    > disconnect from network. An attacker with half a brain can easily load a
    > watchdog program that automatically erases memory,

    What percentage of attackers have half a brain? ;)

    Yes, one *can* approach every single incident worrying that the attacker has
    read things like Thompson's "On Trusting Trust", and possibly re-flashed your
    system BIOS/microcode, and may actively be running a MITM attack at your ISP
    so when you download a new BIOS, you get handed another trojaned BIOS.

    But then, what % of the time do you have a uberhacker posing as a warez kiddie
    using your site to store pirated DVD images of movies? For that matter, have
    you performed steganographic analysis of those "movies" to make sure they
    aren't *REALLY* cleverly disguised rootkits?

    Yes, *IF* you have reason to suspect that your attacker is smarter than the
    average bear^Wscript kiddie, you may want to come up with a better way to cut
    them off the network than pulling the cable. But first convince yourself that
    it isn't Yet Another Script Kiddie - you need to finish off this incident before
    the next one arrives.

    (If you're *really* tech-savvy, and the suspect machine has an ieee1394
    port, you can have your cake and eat it too - use a "field-modified" iPod to
    collect the evidence nice and fast without the hacker's knowledge, and THEN
    pull the plug and proceed with the forensics. ;)

  • Next message: K.M. Jeary: "Re: IIS web server hacked..any tips?"

    Relevant Pages

    • Re: Every parents nightmare
      ... Suspect an ex-mental patient ... After more than 12 hours of hunting for leads, police last night named ... was the attacker, said her daughter had a history of mental illness. ... Other taxi motorcyclists told police that the suspected attacker often ...
      (soc.culture.thai)
    • Re: Trekkies at Pennsic...
      ... skeptical cops (and I somehow suspect that USAian cops are no better ... road, where would an attacker be, and where's the nearest help? ... and I suspect often numbers. ... There are many consequences to violence. ...
      (rec.org.sca)
    • Re: Spacker very busy tonight revising his auctions ..lol
      ... be over the moon, but I won't take any action myself. ... I suspect most police officers could give you examples of people who they ... would you try to investigate the attacker with as ...
      (uk.people.consumers.ebay)
    • RE: Private addresses on public network
      ... anybody accesses those computers from an external network," -- even when the ... JavaScript delivered to the client that causes the client to retrieve ... the attacker, the request results in another JavaScript response that tells ... Moving beyond a single server ...
      (Security-Basics)
    • Re: About War Driving ..
      ... However, MAC filtering does not qualify as defense in depth, ... because the attacker can spoof a valid IP address. ... broadcasting the SSID doesn't hide a network, but just makes it show up ... machines in your building that you can control and check the MAC ...
      (Security-Basics)