3 ms·

really? tell us more about what happened. how did they get from the webserver to your laptop? (e.g. what was listening on your laptop?) I find these sorts of

by lsc 14y ago

really? tell us more about what happened. how did they get from the webserver to your laptop? (e.g. what was listening on your laptop?) I find these sorts of attacks very interesting (and very frightening) because if a sysadmin's desktop is compromised, without the sysadmin noticing, the attacker has access, essentially, to everything the sysadmin accesses with that desktop. The best you can do, as far as I can tell, is to use some sort of 'the private key never leaves the smart card' system, and to run some sort of tripwire-esque intrusion detection system; the latter is key, because even with a theoretically perfect smartcard, if the attacker owns my ssh client binary when I authenticate to the server... it's over.

hippich 14y ago
i do not know details. I am pretty good with security stuff, but this time i had no clue. basically somebody was able to get root permissions on the webserver, 'cos (s)he removed all system log files. Then (s)he was able somehow to hack into my laptop and desktop connected to this webserver via VPN. My local machines were running regular dev stuff: apache, nginx, mysql, etc, but nothing with obvious vulnerabilities. And on top of it - (s)he removed log files, which could be done only by having root access to both machines. Nothing in authlog (i restored it), nothing in wtmp.. I made byte copy for later research, but at this point in time - no clue how this could happened. While I can suspect hosting staff doing this on server - it really boggles my mind how it could be done on two home remote machines, both running different Ubuntu versions. ps: bizarre part was - once i realized it happened, I started doing research on webserver and (s)he started kicking me out and banning IP address in firewall! the only way to finally get to the machine was to reboot it in single mode (my hosting provider allows to reboot it in single mode and start ssh for root account with random password)

by lsc 14y ago

hippich 14y ago

i do not know details. I am pretty good with security stuff, but this time i had no clue. basically somebody was able to get root permissions on the webserver, 'cos (s)he removed all system log files. Then (s)he was able somehow to hack into my laptop and desktop connected to this webserver via VPN. My local machines were running regular dev stuff: apache, nginx, mysql, etc, but nothing with obvious vulnerabilities. And on top of it - (s)he removed log files, which could be done only by having root access to both machines. Nothing in authlog (i restored it), nothing in wtmp.. I made byte copy for later research, but at this point in time - no clue how this could happened. While I can suspect hosting staff doing this on server - it really boggles my mind how it could be done on two home remote machines, both running different Ubuntu versions. ps: bizarre part was - once i realized it happened, I started doing research on webserver and (s)he started kicking me out and banning IP address in firewall! the only way to finally get to the machine was to reboot it in single mode (my hosting provider allows to reboot it in single mode and start ssh for root account with random password)