3 ms·

Notes from a Gibsonian Novel

27 points by luu 6y ago

segfaultbuserr 6y ago
> and some details about harding servers to prevent such an attack from happening (like a link to grsecurity.net which I have to check out, but most of the other stuff is common sense). I was running PaX/Grsecurity on the server for many years, it was a true pioneer to kernel hardening and exploit mitigation, and still offers many hardening techniques not found in the mainland kernels. Unfortunately, it's no longer open to the community. Now my new hope is HardenedBSD [0], which has a roadmap to independently implement all major PaX/grsec features, but there is no ETA. >> Anyway, I'm typing this as I sit across the street from a cybercafe so note not to waste your time backtracing. This is my job, don't take it personal. sincerely and respectfully. > It's tough not to (especially since all this went down while three hurricanes were headed our way) but I guess that's what I get for living in a Gibsonian novel these days. Cyberpunk is now! [0] https://hardenedbsd.org/ https://hardenedbsd.org/
blakesterz 6y ago
This is from 2004, maybe the title can be updated?
- wrinkl3 6y ago
  I read most of the post before glancing at the date and it definitely explained how.. innocent some of it sounded.
rsync 6y ago
"By the way, I still had access to swift.conman.org even after it was patched, I had all known system credentials plus there was a kernel entry using portknocking." I know what port knocking is. I don't understand, however, what the writer is trying to convey here. At first, I thought he was suggesting that he found a remote root exploit in knockd and was using that to gain entry ... however the article makes clear: "A new thing I've learned though—portknocking, something else to look into." ... that they are not using port knocking. Perhaps the attacker is suggesting that he installed a port knock daemon that gave a root login entrypoint ?
- segfaultbuserr 6y ago
  Probably. My understanding is that the attacker installed a rootkit in the system or the kernel, with port-knocking access, which cannot be removed by patching the original exploit. Well, it's why wiping and reinstalling is common sense for any compromised server.
- jandrese 6y ago
  Yeah, I think he had his backdoor active only when port knocked to make it harder for the admins to detect it.
MR4D 6y ago
Need to add “(2004)” to the title.

27 points by luu 6y ago

> and some details about harding servers to prevent such an attack from happening (like a link to grsecurity.net which I have to check out, but most of the other stuff is common sense). I was running PaX/Grsecurity on the server for many years, it was a true pioneer to kernel hardening and exploit mitigation, and still offers many hardening techniques not found in the mainland kernels. Unfortunately, it's no longer open to the community. Now my new hope is HardenedBSD [0], which has a roadmap to independently implement all major PaX/grsec features, but there is no ETA. >> Anyway, I'm typing this as I sit across the street from a cybercafe so note not to waste your time backtracing. This is my job, don't take it personal. sincerely and respectfully. > It's tough not to (especially since all this went down while three hurricanes were headed our way) but I guess that's what I get for living in a Gibsonian novel these days. Cyberpunk is now! [0] https://hardenedbsd.org/ https://hardenedbsd.org/

blakesterz 6y ago

This is from 2004, maybe the title can be updated?

wrinkl3 6y ago
I read most of the post before glancing at the date and it definitely explained how.. innocent some of it sounded.

rsync 6y ago

"By the way, I still had access to swift.conman.org even after it was patched, I had all known system credentials plus there was a kernel entry using portknocking." I know what port knocking is. I don't understand, however, what the writer is trying to convey here. At first, I thought he was suggesting that he found a remote root exploit in knockd and was using that to gain entry ... however the article makes clear: "A new thing I've learned though—portknocking, something else to look into." ... that they are not using port knocking. Perhaps the attacker is suggesting that he installed a port knock daemon that gave a root login entrypoint ?

segfaultbuserr 6y ago
Probably. My understanding is that the attacker installed a rootkit in the system or the kernel, with port-knocking access, which cannot be removed by patching the original exploit. Well, it's why wiping and reinstalling is common sense for any compromised server.
jandrese 6y ago
Yeah, I think he had his backdoor active only when port knocked to make it harder for the admins to detect it.

MR4D 6y ago

Need to add “(2004)” to the title.