Re: Please advise
From: Bit Twister (BitTwister@localhost.localdomain)Date: 05/27/02
- Previous message: gay gobbles: "Re: ANTISEC IS NOT FOR YOU"
- In reply to:(deleted message) Adrian Smith: "Please advise"
- Next in thread: Bill Unruh: "Re: Please advise"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: BitTwister@localhost.localdomain (Bit Twister) Date: Sun, 26 May 2002 23:44:14 GMT
On 27 May 2002 00:20:28 +0100, Adrian Smith wrote:
>
> Hello,
> I appear to have been hacked - which I find a little puzzling.
> Restoring the affected files,
Wrong solution. Format and a clean install.
> upgrading my system and removing
> all unwanted services is annoying but doable,
>
> but why would
> anyone have chosen me as a target?
Because your running a old crackable release. They need your box
to crack into banks and what not to steal credit cards.
First, Unplug your system from the internet, Your machine is a menace to
society and you until it's cleaned it up.
Here is why you need a FORMAT and clean install when your box IS cracked.
http://www.linuxdoc.org/LDP/LG/issue36/kuethe.html
4'th paragraph.
Think about that paragraph.
You cannot use ANY of your pc's utilities to see if your box is cracked
and find what addtional files are installed.
http://www.chkrootkit.org has a program for checking for rootkit installs
on the cracked box. That will tell you about known root kits if you have one.
The cracker may not have installed a rootkit.
What you can do is have a dual boot system. You install a second copy of
your OS and label it Auditor. You never, EVER mount it from the internet OS.
Anytime you THINK you've been cracked, you can boot into Auditor, mount the
internet os partition and start checking the internet OS partitions for new
files and whatnot.
Any time you KNOW your're box is cracked, you should:
o Pull the box off the network. You do not want the police taking
you and your equipment to jail because a cracker used it
to crack a bank or military site. If the cracker removes their
backtracks to their box, you get to do the jail time.
o Put the hardrive(s) into a standalone machine,
mount the disk(s) readonly,
save any data, user files, ...,
o Save a full copy of the disk(s) for your forensic attempt,
save the disk(s) for FBI forensics if it's a Big, BIG dollar loss.
o Re-FORMAT disk drives and do a fresh install from known clean
source to remove any possible back doors and/or password sniffers
the cracker installed.
o Restore your saved files, verify that the restored files
do not have the suid bit set "find / -perm +6000 -ls".
o Have everyone on the box's network change passwords and
tell them that the cracker may have been running a
password sniffer so they will not use the passwords ever again.
Any other boxes logged into from the cracked box should
have their passwords changed.
Install a modern firewall. Example: iptables is better than ipchains.
If you have a spare linux computer, you can use it to port scan
your box with nmap from http://www.insecure.org/nmap/
Get all the vendor updates to your distro.
You might want to read Armoring Linux
http://www.linuxdoc.org/HOWTO/Security-Quickstart-HOWTO/index.html
http://www.enteract.com/~lspitz/linux.html
http://www.ibiblio.org/pub/Linux/docs/HOWTO/Security-Quickstart-Redhat-HOWTO
http://www.ibiblio.org/pub/Linux/docs/linux-doc-project/solrhe/Secur
ing-Optimizing-Linux-RH-Edition-v1.3.txt
http://www.linuxsecurity.com/docs/colsfaq.html
http://www.securityportal.com/lskb/articles/
http://www.securityportal.com/lasg/
keep an eye on
http://www.cert.org/advisories/
For cheap install cd's
http://cart.cheapbytes.com/cgi-bin/cart
top left under Products.
For people accross the pond,
http://www.linuxemporium.co.uk
http://www.linux123.co.uk/
and for down under fokes
http://www.cetustech.com.au/
Never login as root unless you have to.
Always login from the console, no su, telnet, ssh,..
That way a keystroke logger in your user account cannot
catch your root login password.
You can audit your system if you are using the rpm package manager with
rpm -Va | grep '..5' > /tmp/verify.log
Runs for a while; more than 5 minutes.
/tmp/verify.log will contain changes which you have made using
configuration tools
Hope crackers do not put in a rootkit which makes the rpm check obsolete.
I think this has happened, though not sure. On one of my boxes
it cored after about 2 minutes, log looked like it ran but never completes
the audit.
rpm -Va | grep '..5' will give you a warm feeling about what changed.
That warm feeling might turn into the warm feeling you get when
you do not get to the bathroom in time. :(
The cracker could install trojaned files some where else and modify
PATH to use them instead of the files you just checked.
You could look at the report and see
S.5....T c /root/.bash_profile
S.5....T c /root/.bashrc
You see that and say, "Ok, I did change those. No problem."
BZZZZzzit. WRONG answer, Cracker changed your PATH and you are
running his code.
It also does not show additional files. I have created a site file in
/etc/profile.d which puts my site/bin into PATH.
Cracker can add his own cracked.sh file to change/add to PATH and
create aliases to substitute a stock command for his code.
- Next message: Akshay Saxena: "Unix Certification"
- Previous message: gay gobbles: "Re: ANTISEC IS NOT FOR YOU"
- In reply to:(deleted message) Adrian Smith: "Please advise"
- Next in thread: Bill Unruh: "Re: Please advise"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
