On Tue, 9 May 2006, Greg Wiggill wrote:
> Thanks for the replies. Chkrootkit works really well and is easy to use
> but didn't find anything.
>
> I did find however scan.tgz, relaycheck.pl, a sendmail directory in /tmp
> with references to ebay, 60,000 entries in mailq and more.
>
> There were 60 odd processes called 'brute' which had a parameter of
> '100' !
>
> Cleaned it all up (which seems to have stemmed the $200/hr internet/data
> bill) and will probably rebuild later in the week.
Greg,
The first thing you have to do when you suspect a break-in like this is to
disconnect the system from the network or from power. Even when it is in
production your first attention should go to not allow the system to be
exploited anylonger.
You don't have control over the system, if you think you have, you are
wrongÂ. You can't trust anything on the system anymore (not even the
commands you run).
So disconnect the system from the network (and possibly bring it down
without running a command). Then either start building up a new system
and/or investigate who broke in and what has been exposed (using a rescue
image or one of the forensic toolkits). Involve the local federal/national
crime unit to report whatever evidence you have.
The longer you leave the system running (and connected to the network) to
bigger the chance is that an action is taken to abuse whatever is on the
system if it is discovered that they have been exposed. Either
by destroying data or by copying sensitive data (if that wasn't already
the case).
If the system has privacy data of customers/partners/employees (contact
info, social security numbers) you will have to inform all parties that
the information might have been misused. (depending on the detail of the
evidence you may conclude that there was no information leak, but that
could be a deception)
If you don't take any action against these crimes (pursue the case), these
crimes are free from punishment and criminals have nothing to fear (and
probably become rich from it too).
Kind regards,
-- dag wieers, dag@xxxxxxxxxx, http://dag.wieers.com/ --
[all I want is a warm bed and a kind word and unlimited power]
--
redhat-list mailing list
unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list
