[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Server hacked - next...?

On Sun, 2003-06-29 at 19:02, Donovan Baarda wrote:
> Once you get compromised, it's pretty darn hard to get clean without
> starting fresh. Some rootkit compromises do weird stuff like infect
> every binary file you even 'ls'. One system I saw had been compromised
> via an ssh vulerability (old ssh) and rootkit'ed... there was a very
> good security guy doing the (remote) cleanup, and he ended up having to
> install buisybox just so that he had a clean environment he could work
> from. Dispite it being damn hard to clean up, it was just the work of a

Thought I'd better clarify here... he was using buisybox to get a clean
environment so he could remotely shut down the system to a bare minimium
and still get critical stuff off. After that the system was wiped and
fresh re-installed with new passwords. 

Just in case anyone was thinking this showed it was worth resurrecting a
compromised system without a fresh re-install :-(

In then end it is nearly always easier to re-install than to just clean
the system without it, even if the hacker did leave .bash_histories
behind that show everything he/she did.

Donovan Baarda                http://minkirri.apana.org.au/~abo/

Reply to: