4 ms·

Many years ago, that's how I found a vendor-managed (but not vendor-patched) system had been compromised; I went from "why the hell is that multi-pipe command s

by HillRat 10y ago

Many years ago, that's how I found a vendor-managed (but not vendor-patched) system had been compromised; I went from "why the hell is that multi-pipe command segfaulting?"to "why the hell aren't the system binaries stripped?" to "how long has this thing been compromised?"

shshhdhs 10y ago
What is binary stripping?
- Buge 10y ago
  Compiled programs sometimes contain the names of the functions. To reduce binary size and/or discourage reverse engineering, the names can be stripped out.
  - cperciva 10y ago
    Not just names of functions; also names of variables and potentially a great many other things. Stripping binaries generally refers to removing debugging information of all sorts.
    - HillRat 10y ago
      Exactly. In this case -- working from antique memory here -- Solaris binaries were normally stripped, while the compromised versions placed by the hacker weren't, which was an immediate red flag. The system was compromised as part of a very large-scale, probably North Korean, attack that exploited an OpenWindows buffer overflow bug that was fixed many patch-revs ago by the time I saw the system (and shouldn't have been exploitable over the Internet anyway, but the firewall was also not properly set up at the time of compromise). Drive-by hacking, in other words. Luckily their compromised binaries -- specifically a 'ps' that filtered out the hackers' background attack processes -- weren't particularly robust to arbitrary input.
- DCoder 10y ago
  https://en.wikipedia.org/wiki/Strip_(Unix) https://en.wikipedia.org/wiki/Strip_(Unix)
derekp7 10y ago
My favorite incident was back when ISP's gave you Unix shell accounts to get Internet access. I logged into mine, searched back through command history to find the name of an ftp site I had previously connected to, and saw a bunch of "ps -fe" commands. Now I always type in "ps -ef". So I new my account was compromised. (Boring compromise really -- someone sniffed my password, and used my shell account to run an Eggdrop IRC bot).

by HillRat 10y ago

shshhdhs 10y ago

What is binary stripping?

Buge 10y ago
Compiled programs sometimes contain the names of the functions. To reduce binary size and/or discourage reverse engineering, the names can be stripped out.
- cperciva 10y ago
  Not just names of functions; also names of variables and potentially a great many other things. Stripping binaries generally refers to removing debugging information of all sorts.
  - HillRat 10y ago
    Exactly. In this case -- working from antique memory here -- Solaris binaries were normally stripped, while the compromised versions placed by the hacker weren't, which was an immediate red flag. The system was compromised as part of a very large-scale, probably North Korean, attack that exploited an OpenWindows buffer overflow bug that was fixed many patch-revs ago by the time I saw the system (and shouldn't have been exploitable over the Internet anyway, but the firewall was also not properly set up at the time of compromise). Drive-by hacking, in other words. Luckily their compromised binaries -- specifically a 'ps' that filtered out the hackers' background attack processes -- weren't particularly robust to arbitrary input.
DCoder 10y ago
https://en.wikipedia.org/wiki/Strip_(Unix) https://en.wikipedia.org/wiki/Strip_(Unix)

derekp7 10y ago

My favorite incident was back when ISP's gave you Unix shell accounts to get Internet access. I logged into mine, searched back through command history to find the name of an ftp site I had previously connected to, and saw a bunch of "ps -fe" commands. Now I always type in "ps -ef". So I new my account was compromised. (Boring compromise really -- someone sniffed my password, and used my shell account to run an Eggdrop IRC bot).