5 ms·
By examining the timestamp on the log file (defined by the --outfile parameter).
by jakobdabo 8y ago
By examining the timestamp on the log file (defined by the --outfile parameter).
- lima 8y agoPowering off will destroy valuable evidence, though, most payloads live in-memory nowadays. Maybe just disable the NIC? It's not going to do much against a determined adversary, anyway. If he's prepared to turn the NIC back on, he would just kill your inotifywatch first.
- jakobdabo 8y agoHonestly, I didn't give it any serious thought, I came up with the idea and quickly executed it as a PoC in a couple of minutes after that compromised npm package incident a while ago. Disabling the NIC is a nice idea too, it should also be much quicker than shutting the machine down, so, please, feel free to make the script better. The only "clever" thing I did was making sure the honey-pot key comes first in the ~/.ssh directory and that it's big (to gain time to poweroff while it's being transmitted to somewhere). Clearly, this is not a protection against a determined adversary.