3 ms·

>In 2012, during an incident, we watched in real time as somebody logged into an account reserved for Huawei tech support, from the Huawei IP address space in m

by mjolk 13y ago

>In 2012, during an incident, we watched in real time as somebody logged into an account reserved for Huawei tech support, from the Huawei IP address space in mainland China. I'm a little skeptical. I wonder what they mean by "watched," because I doubt that they guessed the tty for reading or that the hacker joined a screen session. What is the likelihood that one would just "happen" to be staring at that server during an "incident."

TrainedMonkey 13y ago
From encrypting and emailing to a hotmail account, it sounds like they connected with Teamviewer/VNC type of software and author was watching what was going on the screen. I am somewhat skeptical as well.
- willvarfar 13y ago
  Unless the support staff use screen sharing software for doing support, and what was witnessed was an unannounced support session?
dmix 13y ago
Google "live incident response" software. The author works for a security company, they get hired to detect malware and intruders. You can remotely connect to machines and analyze memory, commands, etc. It doesn't matter what TTY it was when you have full system access. http://digital-forensics.sans.org/blog/2011/07/21/live-mem-forensic-analysis http://digital-forensics.sans.org/blog/2011/07/21/live-mem-f... https://code.google.com/p/grr/ https://code.google.com/p/grr/ https://www.mandiant.com/resources/download/redline https://www.mandiant.com/resources/download/redline
jessaustin 13y ago
I wonder what they mean by "watched"... My interpretation was that after IDS had identified a particular host, they had tailed syslog (or the equivalent) on that host. The observation that they would have missed it if they hadn't been watching seems to imply that normally their logs wouldn't have retained the level of detail needed to see either the event or the deletion of the logs of the event.
robertgraham 13y ago
It was an internal system. We noticed with 'netstat' that it had a connection to an outside system. 'who' told us it was the account setup for Huawei remote support, and the IP address told us indeed that it was from a Huawei network. The SQL query took 15 minutes to run. We saw it using 'ps'. We then kept dumping their '.bash_history'.
- peterwwillis 13y ago
  That's weird. Bash_history doesn't usually get flushed for every command you run; only when you exit an interactive shell. If you `kill -9 $$` or erase the .bash_history file and create it as a directory, it loses the history. The exception is if you create a custom PROMPT_COMMAND="history -a; history -n", which would append on each new bash prompt. (You'd think a hacker would know these things...?) As an alternative to dumping history, if your system has perl and strace and you want to watch a live ssh or bash session, I wrote a script that will do that. https://github.com/psypete/public-bin/blob/public-bin/src/system/dumpfd.pl https://github.com/psypete/public-bin/blob/public-bin/src/sy...
  - acdha 13y ago
    That "history -a" bit is extremely common if the environment has shared storage like NFS in use or multiple shells are common. It would not surprise me at all to see it on by default on an account used for debugging / support purposes as a cheap audit measure.
- gwu78 13y ago
  It seems hard to believe someone doing something like this would not at least try to cover their tracks. export HISTSIZE=0? And how do you know these were unmodified versions of netstat, who and ps that you ran? Do they have mtree in this OS? I'm no security expert but this little story just sounds very unsophisticated given the seriousness you are attributing to it.

by mjolk 13y ago

TrainedMonkey 13y ago

From encrypting and emailing to a hotmail account, it sounds like they connected with Teamviewer/VNC type of software and author was watching what was going on the screen. I am somewhat skeptical as well.

willvarfar 13y ago
Unless the support staff use screen sharing software for doing support, and what was witnessed was an unannounced support session?

dmix 13y ago

Google "live incident response" software. The author works for a security company, they get hired to detect malware and intruders. You can remotely connect to machines and analyze memory, commands, etc. It doesn't matter what TTY it was when you have full system access. http://digital-forensics.sans.org/blog/2011/07/21/live-mem-forensic-analysis http://digital-forensics.sans.org/blog/2011/07/21/live-mem-f... https://code.google.com/p/grr/ https://code.google.com/p/grr/ https://www.mandiant.com/resources/download/redline https://www.mandiant.com/resources/download/redline

jessaustin 13y ago

I wonder what they mean by "watched"... My interpretation was that after IDS had identified a particular host, they had tailed syslog (or the equivalent) on that host. The observation that they would have missed it if they hadn't been watching seems to imply that normally their logs wouldn't have retained the level of detail needed to see either the event or the deletion of the logs of the event.

robertgraham 13y ago

It was an internal system. We noticed with 'netstat' that it had a connection to an outside system. 'who' told us it was the account setup for Huawei remote support, and the IP address told us indeed that it was from a Huawei network. The SQL query took 15 minutes to run. We saw it using 'ps'. We then kept dumping their '.bash_history'.

peterwwillis 13y ago
That's weird. Bash_history doesn't usually get flushed for every command you run; only when you exit an interactive shell. If you `kill -9 $$` or erase the .bash_history file and create it as a directory, it loses the history. The exception is if you create a custom PROMPT_COMMAND="history -a; history -n", which would append on each new bash prompt. (You'd think a hacker would know these things...?) As an alternative to dumping history, if your system has perl and strace and you want to watch a live ssh or bash session, I wrote a script that will do that. https://github.com/psypete/public-bin/blob/public-bin/src/system/dumpfd.pl https://github.com/psypete/public-bin/blob/public-bin/src/sy...
- acdha 13y ago
  That "history -a" bit is extremely common if the environment has shared storage like NFS in use or multiple shells are common. It would not surprise me at all to see it on by default on an account used for debugging / support purposes as a cheap audit measure.
gwu78 13y ago
It seems hard to believe someone doing something like this would not at least try to cover their tracks. export HISTSIZE=0? And how do you know these were unmodified versions of netstat, who and ps that you ran? Do they have mtree in this OS? I'm no security expert but this little story just sounds very unsophisticated given the seriousness you are attributing to it.