[ale] Comprimised System

[Robert L. Harris]

Pull the hard drives out and put htem on a shelf.  Rebuild off new
drives so you can do a post-mortem.  Then when you can image the hard
drives and mount the images loopback, read only so you don't accidently 
modify them or run something in $PATH.  Now you can use "find" to find
the directories you're looking for as well as some other tools.  You can
also look at:

http://odessa.sourceforge.net/
http://www.sleuthkit.org/sleuthkit/desc.php

Both are good forensics tools.




Thus spake Nick Travis (wormfishin at gmail.com):

> We have a system at work that has been comprimised.  It looks like
> they got in and used several different executable files, I've got the
> command history however I don't think it is complete.  For example I
> see that direcotories were created, but I never saw that they were
> removed and I can't find them.  It looks like about 5 ftp sites were
> hit and there was about 3 wget commands to pull down files.  Also
> apache was downloaded and installed, even though it was already
> running on the system.  So here's my question, I know that rebuilding
> the system is the only way to be sure that there is nothing else
> hidden on it, but that's not an option at this point.  Are there any
> good HowTo's or books out there that can give me some direction on how
> to check they system for irregularites?  This is the first time I've
> dealt with this so I would like to learn as much as I can about it,
> I've already determined how they got in.  A user made thier password
> the same as thier login name, which obviously is no longer allowed. 
> BTW the system is running Red Hat 7.3.
> 
> Nick
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://www.ale.org/mailman/listinfo/ale

:wq!
---------------------------------------------------------------------------
Robert L. Harris                     | GPG Key ID: E344DA3B
                                         @ x-hkp://pgp.mit.edu
DISCLAIMER:
      These are MY OPINIONS             With Dreams To Be A King,
       ALONE.  I speak for              First One Should Be A Man
       no-one else.                       - Manowar

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature