7 ms·
One thing I have always wondered: how do companies like this actually detect such a breach in the first place? HTTP and SSH log files? Also, how do they ensure
by rbinv 9y ago
One thing I have always wondered: how do companies like this actually detect such a breach in the first place? HTTP and SSH log files?
Also, how do they ensure that their systems are no longer compromised?
- troydavis 9y agoOf the 6-7 breaches I've heard the details of, they were detected because either: - an engineer stumbled upon clear evidence of a rootkit, like a leftover dotfile or shell history entries - the exfiltrated data got used and someone noticed (Different story for active intrusions, where the intruder is detected when they first breach a system. At least anecdotally, the passive after-the-fact detection above seems more common, though.)
- rbinv 9y agoThanks for your reply. I assume many startups use AWS or GCE (with auto scaling) and thus don't necessarily setup/SSH into each and every machine/VM. Wouldn't this make rootkit detection more difficult? edit: how would an active intrusion detection take place?
- pmoriarty 9y agoYou don't have to ssh in to a system in order to detect a rootkit or intrusion. You could run a rootkit detection app like rkhunter[1] or chrootkit[2] (though I don't know how good these programs are at doing what they claim to do) or run a filesystem integrity monitoring app or HIDS[3] like Samhain[4]. You might also pick up intrusions via a network intrusion detection system like Snort[5]. [1] - https://en.wikipedia.org/wiki/Rkhunter https://en.wikipedia.org/wiki/Rkhunter [2] - https://en.wikipedia.org/wiki/Chkrootkit https://en.wikipedia.org/wiki/Chkrootkit [3] - https://en.wikipedia.org/wiki/Host-based_intrusion_detection_system https://en.wikipedia.org/wiki/Host-based_intrusion_detection... [4] - https://en.wikipedia.org/wiki/Samhain_(software) https://en.wikipedia.org/wiki/Samhain_(software) [5] - https://en.wikipedia.org/wiki/Snort_(software) https://en.wikipedia.org/wiki/Snort_(software)
- ryanlol 9y ago> don't know how good these programs are at doing what they claim to do They're good for checking old backups to see if you were hacked in the 90s, not so useful for today.
- throwanem 9y agoThe first two, sure. Snort, at least, remains under active maintenance, and while I'm not in network security myself any more, those I know who still are have had good things to say about it.
- pmoriarty 9y agoSo what would you use today?
- ryanlol 9y agoI don't think there is any useful software intended for the same purpose as those two. You'll need something like Samhain to spot the breach when it happens.
- trashcan 9y agoIt will definitely require some configuration, but AIDE is an awesome tool. You take hashes of files when they are in a known good state (and are not supposed to change) and then monitor them for changes. http://aide.sourceforge.net/ http://aide.sourceforge.net/ It takes a good amount of setup because there are a lot of files that routinely change that you will want to ignore.
- zitterbewegung 9y agoFor a really great book about an Active Intrusion this is a classic. https://www.amazon.com/Cuckoos-Egg-Tracking-Computer-Espionage/dp/1416507787 https://www.amazon.com/Cuckoos-Egg-Tracking-Computer-Espiona...
- jk563 9y agoIs this the one that started to realise what was happening due to unpaid time on a machine amounting to 25c or similar?
- packetized 9y agoThat's the one. I remember reading it in 1991 or 1992, and just having my mind blinded by the whole story.
- bungie4 9y agoYup. Cliff Stoll. His first book is a great read. The second as well, but he caught a lot of flack for his 'Luddite' views. Personally, and with the aid of hindsight, I think he just undershot on his predictions.
- throwanem 9y agoI think so. It's also the one in which the protagonist stalled the attacker by means of a keyring, which is not so much a thing you can do any more.
- ebcase 9y agoI re-read Cuckoo's Egg recently, and it was still a riveting read! Especially when considering that it all happened over telnet.
- LyndsySimon 9y agoLastPass issued a security warning in June 2015 that was originally triggered by their having detected network activity from an unknown source. For what it's worth, their handling of this event was the reason I adopted LastPass. https://blog.lastpass.com/2015/06/lastpass-security-notice.html/ https://blog.lastpass.com/2015/06/lastpass-security-notice.h...