full-disclosure - Re: one of my servers has been compromized

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 6 Dec 2011 11:48:02 -0800
From: Gage Bystrom <themadichib0d@...il.com>
To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: one of my servers has been compromized

My bad, should have said that you can't trust the md5sum tampering(since
you stated to have a static copy on the flash drive) but you couldn't trust
it since you couldn't trust the system calls.

The immediate moment you have to worry about a legit userland rootkit you
have to worry about a kernel rootkit. After all you have to consider the
psychology of the attacker. If you were to compromise a box, and cared
enough to hide a backdoor they cannot detect without static, write proof
media, then you care enough to go the extra step for a kernel rootkit.
Otherwise you would be spending even more time and effort to make your
userland kit work to satisfaction for a far weaker hold on the box. It
would simply be idiotic. And I think we can all agree that an attacker able
to do either of the above is not an idiot.

On Dec 6, 2011 10:19 AM, "Paul Schmehl" <pschmehl_lists@...rr.com> wrote:
>
> A "poor man's" root kit detector is to take md5sums of critical system
binaries (you'd have to redo these after patching), and keep the list on an
inaccessible media (such as a thumb drive).  If you think the system is
compromised, run md5sum against those files, and you will quickly know. You
could even keep statically compiled copies on the thumb drive to use in an
investigation.

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/