Re: Monitoring a file?

From: Lowell Gilbert (freebsd-questions-local_at_be-well.ilk.org)
Date: 11/24/03

  • Next message: Antoine Jacoutot: "Re: hard drive bench" 
    To: freebsd-questions@freebsd.org
To: "Cordula's Web" <cpghost@cordula.ws>
Date: 23 Nov 2003 18:06:12 -0500

    "Cordula's Web" <cpghost@cordula.ws> writes:

    > I've finally found the culprit with a traditional method:
    > * md5 (binary from an uncompromised machine) on all files
    > * reinstalling from scratch (not buildworld, but really
    > installing from FTP)
    > * md5 again and diff.

    [snip]

    > Ugh... system clean again at last. :)

    You can't be sure. The attacker probably put an suid binary somewhere
    besides the normal system binaries, in which case it's still there and
    you may still be vulnerable. When you know you've been hacked, you
    need to wipe the disk and *really* reinstall from scratch. And be
    very careful about what you restore from backups, too.
    _______________________________________________
    freebsd-questions@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-questions
    To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"

  • Next message: Antoine Jacoutot: "Re: hard drive bench"

    Relevant Pages

    • [NEWS] Java Sandbox and Stateful Firewalls Interaction
      ... The attacker must lure the victim to a carefully ... The attacker creates a specifically crafted web site. ... The victim's browser downloads the applet and begins to run it. ... A FTP server on the same machine that hosts the originating web site ...
      (Securiteam)
    • Re: Mitigate FTP
      ... You should consider implementing an Network Intrusion Prevention System dependent on your firewall technology and network topology this should not be to hard to implement. ... Sniffing will only be possible if the attacker is in the same network segment as your FTP service, on a vulnerable downstream or upstream router from yourselves or people who access the FTP. ...
      (Pen-Test)
    • Re: Question: FTP via alternate port
      ... While FTP can be very hard to use in that kind of situation, the attacker could simply use http or https to transfer files if those port are open. ... Your issue is more than just with FTP server, FTP is probably the worst protocol to use in that kind of situation. ... Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! ...
      (Pen-Test)
    • RE: Mitigate FTP
      ... Looks like an interesting script. ... It's possible for an attacker to spoof the source IP to ... If you have to use FTP, and I've seen companies that still do, a whitelist ... Security Trends Report from Cenzic ...
      (Pen-Test)
    • ftpd.c DoS Fix
      ... service attacks where an attacker can lock out all other users from ... the process is bound to port 20, ... data connections during this 90 second wait. ... log into the test victim FTP server ...
      (FreeBSD-Security)