full-disclosure - Re: Supporters urge halt to, hacker's, extradition to US

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 29 Sep 2008 17:40:30 -0400
From: Valdis.Kletnieks@...edu
To: Kyrian <kyrian@....org>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Supporters urge halt to, hacker's,
	extradition to US

On Mon, 29 Sep 2008 21:44:22 BST, Kyrian said:

> >   A message left by him on a system:
> >   
> Changing the /etc/motd file or equivalent is hardly costly, and hardly 
> massive damage, no? Hypothetically speaking, if I wanted to do as little 
> damage as possible and make someone get the message I'd been in there, 
> that's probably what I'd do.

Look at it from the other end.  You logon one day, and find that person or
persons unknown have screwed with your /etc/motd file.

Question 1: How long does it take you to *confirm* that the /etc/motd change
was the only thing screwed with on the system, and that you don't have *any*
other files that were inappropriately accessed and/or modified?  Remember in
your analysis to allow for files that were modified and backdoored, then
the backdoored versions are in your backup system - and then the hacker puts
the unmodified versions back.  If you have to restore that file, you've just
brought a backdoor onto your system...

Question 2: At your current pay *plus overhead* in <local monetary units>/hour
(assuming you're actually employed), how much does the answer to Question 1 end
up costing?

For instance - if it takes you 5 hours to *prove* that nothing else on the
server has been messed around with (consider the fact that on most servers,
you can't just do a 'find / -newer /known/good/timestamp' because you'll drown
in false-positives). If your salary is $20/hour and overhead (benefits, cost
of office space, work computers, electricity, etc) is $10/hour, that little
escapade just cost your company $600.

Oh yeah - if you decide to take the server down so the normal production
workload doesn't make the analysis intractable, you get to redo your answer to
Question 2 and also add in the cost of all the employees that just got idled
because the data they needed just became unavailable.

Unless your site has the policy "screw it, I'll just either ignore it and do nothing
at all, or just re-image and forget it ever happened", incidents where
"only one file got modified" become very costly very quickly.

Go re-read Cliff Stoll's "The Cuckoo's Egg" - *that* whole story started off
because of a $0.50 discrepancy in an accounting run.  Just because it looks
trivial and ignorable rarely means it actually is.

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/