3 ms·
At first I felt bad that I didn't know all the tricks the author knew, but then I realized I would never, ever try to clean a machine. I would copy (and verify
by drzaiusapelord 12y ago
At first I felt bad that I didn't know all the tricks the author knew, but then I realized I would never, ever try to clean a machine. I would copy (and verify) and config files I needed and just spin up a new vm. Its not worth the time and there's a slim chance you'll actually catch everything. Funny how he didn't just run rootkit hunter. I wonder if it would have detected this hack.
I'm also starting to think that the move from Linux being a sysadmin-only OS to being something that can casually be spun up by even the most jr of developers, means we're having a Microsoft circa 1997 moment where security needs to be commoditized. I wonder if any of the few commercial AV's for Linux are updated frequently enough to catch hacks like these.
- jacquesm 12y agoI think he's too clever for his own good. This machine should have been considered beyond salvage, remove any precious data (you did have a backup, didn't you?) and re-image. I've had to recover data from hacked boxes a few times for 'brand new customers' and the first thing I do with a system like that is to make sure I get a console wired up and the uplink disconnected. No point in taking chances.