full-disclosure - Re: one of my servers has been compromized

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <11420.1323192995@turing-police.cc.vt.edu>
Date: Tue, 06 Dec 2011 12:36:35 -0500
From: Valdis.Kletnieks@...edu
To: Dan Ballance <tzewang.dorje@...il.com>
Cc: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: one of my servers has been compromized

On Mon, 05 Dec 2011 13:53:21 GMT, Dan Ballance said:

> Also, am I correct to think that using something like tripwire is the best
> way to detect root kits properly, but that it obviously needs installing
> when the box is fresh and before it has been physically connected to a
> network?

tripwire needs to be installed on a known-good system.  This is obviously
*easier* before you connect to a network, but you certainly should *not*
say "zomg I connected it to a network for 35 seconds, I'll not be able to
use tripwire ever again".

The bigger hassle with tripwire is patching your system - the recommended
way is to:

1) re-run a tripwire report and verify your system looks OK.
2) patch
3) re-run tripwire to report all changed files
4) Verify that only things changed are files you intended to patch, 
   4a) and that you got the versions you intended
5) re-re-run tripwire to commit the new values to the tripwire database.

Note that 4a is often harder than it looks - even if you have a GPG-signed
RPM, there's often scripts run at install/update time that screw around with
other files (I'm looking at you, every program that integrates itself into
Gnome and scribbles into /etc/gconf ;)

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/