Re: compromised network

From: Jason Coombs (jasonc_at_science.org)
Date: 12/30/03

  • Next message: J. Yoon: "XP box maintainance and lockdown" 
    Date: Tue, 30 Dec 2003 08:39:38 -1000
To: erisk <erisk@iinet.net.au>

    Aloha, Dana, et al:

    Image and sniff all you want, if you don't know what the vulnerability
    was that the intruder exploited to get in then how do you expect to be
    "secure" once you've finished reformatting and restoring everything?

    If you weren't capturing all data on your network during the attack, and
    if you haven't analyzed the capture and/or pinpointed the vulnerability
    that was exploited, then just assume you're going to be owned again and
    go back to whatever it is that you do in between scheduled emergencies.

    Without full disclosure there can be no security.

    Sincerely,

    Jason Coombs
    jasonc@science.org

    erisk wrote:
    > This might through some flame into the group but I would disagree with most
    > peoples responses here..
    >
    > Firstly do you have formailsed Incident respone plan? If so follow that to
    > the letter..Secondly you should, for legal reasons, contact a forensic
    > specialist to image the hard drives, capture packets etc, before wiping all
    > you data and consult him for further advice (if your company has the
    > budget). After this has been all then follow standard hardening
    > procedures...
    >
    >
    > ----- Original Message -----
    > From: "Glenn Pearl" <glennp@datasync.com>
    > To: "'Dana Rawson'" <absolutezero273c@nzoomail.com>;
    > <security-basics@securityfocus.com>
    > Sent: Tuesday, December 30, 2003 2:10 AM
    > Subject: RE: compromised network
    >
    >
    >
    >>The only way to really know that your systems are clean is to start over
    >>- reformat the hard drives, reinstall apps securely and restore data
    >>from backup. Do not allow any access to the boxes until you have
    >>completely locked them down.
    >>
    >>I am in the process of teaching myself these very steps. I'm using
    >>Windows 2000 and IIS 5, and working with the NSA Windows 2000 security
    >>guides and policy templates in combination with Stefan Norberg's
    >>"Securing Windows NT/2000 Servers for the Internet" (O'Reilly) and tons
    >>of notes courtesy these Security Focus lists (thanks, everybody!) and
    >>articles and Google. I'm also learning how to use scanning tools and
    >>IDS such as nmap, nessus, snort, etc.
    >>
    >>Legal action - I'm sure there are others on this list who are far more
    >>helpful than I at answering that one. Personally, I wouldn't waste any
    >>time with it or tracking the intruders via ethereal, and instead focus
    >>on lessening the chance of such compromises in the future. Search the
    >>list archives and GooGroups for info on firewalls, proxies, IDS...
    >>
    >>Glenn Pearl
    >>
    >>
    >>>-----Original Message-----
    >>>From: Dana Rawson [mailto:absolutezero273c@nzoomail.com]
    >>>Sent: Friday, December 26, 2003 1:22 PM
    >>>To: security-basics@securityfocus.com
    >>>Subject: compromised network
    >>>

    ---------------------------------------------------------------------------
    ----------------------------------------------------------------------------

  • Next message: J. Yoon: "XP box maintainance and lockdown"

    Relevant Pages

    • RE: Scanners and unpublished vulnerabilities - Full Disclosure
      ... The VNA seems like a fair solution. ... I would also like to further emphasize the point of proprietary IDS ... >> vulnerability and searches for more information on that vulnerability ... Many companies treat security breaches in a reactive ...
      (Pen-Test)
    • Re: IDS is dead, etc
      ... I think we are on the same page as to the utility of IDS systems. ... I really like your description of NIDS as AV scanners for the network. ... **FREE Vulnerability Assessment Toolkit - WhitePapers - Live Demo ...
      (Focus-IDS)
    • Re: On IDS Evasion, Vulnerabilities, and Vendor Hype
      ... On IDS Evasion, Vulnerabilities, and Vendor Hype ... encoding, unlike %u encoding." ... How long was it before some vendors ... > vulnerability. ...
      (Focus-IDS)
    • RE: "false positive" inanity
      ... What if you have a REALLY large network? ... > What Im trying to get across here is a revision to the IDS ... > configuration blinding or post-event vulnerability analysis. ... > Whereas some IDS vendors actually brag about how many signatures their ...
      (Focus-IDS)
    • On IDS Evasion, Vulnerabilities, and Vendor Hype
      ... On IDS Evasion, Vulnerabilities, and Vendor Hype ... IDS vendors sometimes must completely rewrite parts of their engines ... Eeye cast the first stone with their advisory %u encoding IDS bypass ... vulnerability. ...
      (Focus-IDS)