6 ms·
Sorry, but this is ridiculous: "Our analysis uncovered (among other things) a hacked SSH daemon, which was modified to do password capture. We don’t have reaso
by nodata 16y ago
Sorry, but this is ridiculous:
"Our analysis uncovered (among other things) a hacked SSH daemon, which was modified to do password capture. We don’t have reason to [believe] the attacker was successful in collecting passwords."
You don't have reason to believe they weren't either. Why write this?
- JoachimSchipper 16y agoPerhaps one would have expected log entries or an updated atime?
- nodata 16y agoSomeone has root. Everything on the system can't be trusted. The assumption should be the opposite, by default.
- JoachimSchipper 16y agoThere's a difference between digital forensics and "the virus scanner says it's clean, let's start loading the credit card data". As a forensics statement, this makes perfect sense - and note that they (say they) have reset all passwords, so it's not like they rely on this.
- joh6nn 16y agoi can verify that i received a password reset email from sourceforge on saturday, that explained there had been an attempt made to get at the passwords, and that rather than wasting time speculating on if they had been compromised, they were just doing a system wide password reset.
- ams6110 16y agoThe logs may (should) be on a separate loghost, which is otherwise isolated from the machines it's servicing. Assuming this is the case, and those logs show no evidence of further penetration, that's evidence in favor of the conclusion that the damage was contained. However you're right, once an attacker has root it's very hard to take anything at face value after the fact.