5 ms·

Thanks for your reply. I assume many startups use AWS or GCE (with auto scaling) and thus don't necessarily setup/SSH into each and every machine/VM. Wouldn't

by rbinv 9y ago

Thanks for your reply. I assume many startups use AWS or GCE (with auto scaling) and thus don't necessarily setup/SSH into each and every machine/VM. Wouldn't this make rootkit detection more difficult? edit: how would an active intrusion detection take place?

pmoriarty 9y ago
You don't have to ssh in to a system in order to detect a rootkit or intrusion. You could run a rootkit detection app like rkhunter[1] or chrootkit[2] (though I don't know how good these programs are at doing what they claim to do) or run a filesystem integrity monitoring app or HIDS[3] like Samhain[4]. You might also pick up intrusions via a network intrusion detection system like Snort[5]. [1] - https://en.wikipedia.org/wiki/Rkhunter https://en.wikipedia.org/wiki/Rkhunter [2] - https://en.wikipedia.org/wiki/Chkrootkit https://en.wikipedia.org/wiki/Chkrootkit [3] - https://en.wikipedia.org/wiki/Host-based_intrusion_detection_system https://en.wikipedia.org/wiki/Host-based_intrusion_detection... [4] - https://en.wikipedia.org/wiki/Samhain_(software) https://en.wikipedia.org/wiki/Samhain_(software) [5] - https://en.wikipedia.org/wiki/Snort_(software) https://en.wikipedia.org/wiki/Snort_(software)
- ryanlol 9y ago
  > don't know how good these programs are at doing what they claim to do They're good for checking old backups to see if you were hacked in the 90s, not so useful for today.
  - throwanem 9y ago
    The first two, sure. Snort, at least, remains under active maintenance, and while I'm not in network security myself any more, those I know who still are have had good things to say about it.
  - pmoriarty 9y ago
    So what would you use today?
    - ryanlol 9y ago
      I don't think there is any useful software intended for the same purpose as those two. You'll need something like Samhain to spot the breach when it happens.
trashcan 9y ago
It will definitely require some configuration, but AIDE is an awesome tool. You take hashes of files when they are in a known good state (and are not supposed to change) and then monitor them for changes. http://aide.sourceforge.net/ http://aide.sourceforge.net/ It takes a good amount of setup because there are a lot of files that routinely change that you will want to ignore.

by rbinv 9y ago

pmoriarty 9y ago

You don't have to ssh in to a system in order to detect a rootkit or intrusion. You could run a rootkit detection app like rkhunter[1] or chrootkit[2] (though I don't know how good these programs are at doing what they claim to do) or run a filesystem integrity monitoring app or HIDS[3] like Samhain[4]. You might also pick up intrusions via a network intrusion detection system like Snort[5]. [1] - https://en.wikipedia.org/wiki/Rkhunter https://en.wikipedia.org/wiki/Rkhunter [2] - https://en.wikipedia.org/wiki/Chkrootkit https://en.wikipedia.org/wiki/Chkrootkit [3] - https://en.wikipedia.org/wiki/Host-based_intrusion_detection_system https://en.wikipedia.org/wiki/Host-based_intrusion_detection... [4] - https://en.wikipedia.org/wiki/Samhain_(software) https://en.wikipedia.org/wiki/Samhain_(software) [5] - https://en.wikipedia.org/wiki/Snort_(software) https://en.wikipedia.org/wiki/Snort_(software)

ryanlol 9y ago
> don't know how good these programs are at doing what they claim to do They're good for checking old backups to see if you were hacked in the 90s, not so useful for today.
- throwanem 9y ago
  The first two, sure. Snort, at least, remains under active maintenance, and while I'm not in network security myself any more, those I know who still are have had good things to say about it.
- pmoriarty 9y ago
  So what would you use today?
  - ryanlol 9y ago
    I don't think there is any useful software intended for the same purpose as those two. You'll need something like Samhain to spot the breach when it happens.

trashcan 9y ago

It will definitely require some configuration, but AIDE is an awesome tool. You take hashes of files when they are in a known good state (and are not supposed to change) and then monitor them for changes. http://aide.sourceforge.net/ http://aide.sourceforge.net/ It takes a good amount of setup because there are a lot of files that routinely change that you will want to ignore.