3 ms·

First, thanks for disclosing this. Second - and any incident response team will tell you this - patching and removing the backdoor is not enough. You have to w

First, thanks for disclosing this. Second - and any incident response team will tell you this - patching and removing the backdoor is not enough. You have to wipe that machine. It's not uncommon for an attacker to leave multiple backdoors. Even if you don't think they got root, you have to wipe it completely.

jpswade 14y ago
Destroying data is never a solution.
- deleted 14y ago
  [deleted]
- randallsquared 14y ago
  That's certainly not true, but in any case, I don't think Larry was suggesting you shouldn't take a backup first. :)
- martinced 14y ago
  You got downvoted by several people because what you say is not related to the person you answered to. Typically when a breach-in happens you do two things: 1. backup the entire disks for forensics purposes 2. wipe everything clean, re-install the latest version of the OS + all the latest patches, re-install the latest version of the apps. Nowhere did parent suggest to "destroy evidence".
  - amw 14y ago
    Not that this guy said "evidence" either ("data" was the word), but otherwise I agree
pifflesnort 14y ago
Nowadays, it's not enough to wipe the machine. You have to toss (or, at least, re-image) the hardware. Modern servers have firmware running on internal devices, including Linux runnning on full ARM cores, that can be 1) imaged from the base OS, and 2) have full control over hardware or other important data. This includes: - IPMI Modules: http://fish2.com/ipmi/itrain.html http://fish2.com/ipmi/itrain.html - HDD Controllers (in your HDD/SSD drives): http://www.arm.com/markets/enterprise/hdd-ssd.php http://www.arm.com/markets/enterprise/hdd-ssd.php ... as well as ethernet controllers, any devices with PCI option ROMs (they can control boot), and quite a few other things. This essentially means that you have a bunch of fixed, poorly documented, runtime reconfigurable and re-imageable hardware, with full access to data and system resources.

jpswade 14y ago

Destroying data is never a solution.

deleted 14y ago
[deleted]
randallsquared 14y ago
That's certainly not true, but in any case, I don't think Larry was suggesting you shouldn't take a backup first. :)
martinced 14y ago
You got downvoted by several people because what you say is not related to the person you answered to. Typically when a breach-in happens you do two things: 1. backup the entire disks for forensics purposes 2. wipe everything clean, re-install the latest version of the OS + all the latest patches, re-install the latest version of the apps. Nowhere did parent suggest to "destroy evidence".
- amw 14y ago
  Not that this guy said "evidence" either ("data" was the word), but otherwise I agree

pifflesnort 14y ago

Nowadays, it's not enough to wipe the machine. You have to toss (or, at least, re-image) the hardware. Modern servers have firmware running on internal devices, including Linux runnning on full ARM cores, that can be 1) imaged from the base OS, and 2) have full control over hardware or other important data. This includes: - IPMI Modules: http://fish2.com/ipmi/itrain.html http://fish2.com/ipmi/itrain.html - HDD Controllers (in your HDD/SSD drives): http://www.arm.com/markets/enterprise/hdd-ssd.php http://www.arm.com/markets/enterprise/hdd-ssd.php ... as well as ethernet controllers, any devices with PCI option ROMs (they can control boot), and quite a few other things. This essentially means that you have a bunch of fixed, poorly documented, runtime reconfigurable and re-imageable hardware, with full access to data and system resources.