Forgot your password?
typodupeerror
Security The Internet

We've Been Hacked... or Have We? 65

Posted by Cliff
from the better-security-fu-requested dept.
hidden_fire asks: "I recently got a job as a Web Programmer at a web company that hosts many sites. The company had many badly firewalled Windows and Linux servers without any security patches, and a shared administrator password. I warned them that they needed to improve their security, but was ignored until a hacker kindly emailed them proof that their credit-card server was compromised, and the Sasser Worm took us offline. Now, I've been allowed to rebuild the compromised box and tighten our firewalling, but our other servers show many signs of possibly being compromised including unexplained outgoing traffic, a Linux kernel lockup, strange ports being open, and performance issues. I think we are possibly providing hosting for undetectable spammers but the boss thinks I'm paranoid, and says that I need to be working on paying work, not security. Has anybody else been in this situation? How can I detect these guys if their tools don't show in virus scans?"
This discussion has been archived. No new comments can be posted.

We've Been Hacked... or Have We?

Comments Filter:
  • by AKnightCowboy (608632) on Friday June 25, 2004 @08:49PM (#9533959)
    If you don't know what was changed then you need to rebuild any machines suspected of being compromised from scratch and restore the data from a clean backup. Unless you're very sure your file checksum database is accurate (you run tripwire or aide hopefully) you will need to rebuild. Don't screw around and contribute to the global insecurity of the Internet.. especially with people's credit card data at stake!!! WTF is your company thinking keeping that on a public network?
  • Sounds like (Score:3, Insightful)

    by hammock (247755) on Friday June 25, 2004 @08:56PM (#9533987) Homepage
    Clifford Stoll, Cuckoos Egg.

    Lesson to learn is secure that stuff, what they don't know will hurt them.

    http://www.programming-reviews.com/Cuckoos_Egg_Tra cking_a_Spy_Through_the_Maze_of_Computer_Espionage _0743411463.html [programming-reviews.com]
  • by PhaseBurn (44685) <PhaseBurn@PhaseBurn.net> on Friday June 25, 2004 @08:59PM (#9534001) Homepage
    Windows: use Moosoft's The Cleaner (http://www.moosoft.com/products/cleaner/download/ ) - it can detect trojans and things that virus scanners don't pick up...

    Linux: nmap the box from a trusted PC on the same network, and then build a copy of netstat on the trusted PC for the server in question... copy the binary over, and run "netstat -pultw" as root... it'll list all ports that are listening for connections, and, the processes that are opening them (by PID, and usually by name). The reason for the clean copy is that a lot of root kits replace netstat on infection...

    Hope this helps...
    • by benjamindees (441808) on Friday June 25, 2004 @09:08PM (#9534045) Homepage
      Ugh. Running *any* binary on a possibly compromised machine is questionable. That's why Windows virus scanners suck: once you bypass them *once* they become irrelevant.

      Under Linux, boot from a read-only media (rescue cd) and verify the md5sums of the files installed against the installation cds. Any binaries that have changed will stick out like a sore thumb. Debian (and other .deb based distros) includes a program to do this, debsums, as well as rpm-based distros (Redhat/Fedora), rpm -V.

      I don't know if there's anything similar for Windows, but if there is, it probably isn't free ;)
      • by flonker (526111) on Saturday June 26, 2004 @01:25AM (#9535277)
        On Windows,...

        "netstat -n -a | more" will tell you what ports are in use. This is a simple preliminary check. It will give you an idea of what to look for.

        Fport [slashdot.org] is a great little tool that will tell you what processes are listening on what ports. It's many times better than netstat. This will likely give most trojans. Look for ports you don't recognize, and programs you don't recognize. Keep in mind that fport lists outgoing connections as well as incoming ones, and doesn't differentiate. Any ports or programs you don't recognize, google it and figure out what it is, how it got there, etc.

        Next, check the standard startup locations. HKLM/Software/Microsoft/Windows/CurrentVersion/Run *
        and the same under HCU/Software/Microsoft/Windows/CurrentVersion/Run* are the most popular places trojans are placed.

        Also, look for hidden directories, and large files. You may be hosting an FTP Warez dump. Look for *.nfo;*.rar;*.ace;*.0*;*gamez*;*appz* and anything else you can think of.

        Unfortunately, I don't know of any Md5 sum tools or anything for windows.

        Finally, rebuild, if you can. Rebuild from current data, and known good code. Don't trust code on the compromised machine. Best practice for recovering from a compromise type stuff. That really should be your first, last, and only step, but I doubt you'll be allowed, considering that your boss isn't taking security seriously.
    • Even the clean netstat binary will not work on a Linux machine that has been compromised with adore. Adore is a kernel module that blocks netstat (and others) at the kernel level from seeing the compromised ports, as well as making certain parts of the filesystem (such as those holding the backdoor software) invisible to userspace. Really an amazing little hack.

      The only real way to bypass it is from outside the compromised kernel, which means either a clean boot off of a boot CD or such (which would be p
  • by Karora (214807) on Friday June 25, 2004 @09:00PM (#9534004) Homepage

    Here's a couple of things you could do:

    Download and build chkrootkit [chkrootkit.org]. This will detect a lot (most?) stealthed kits on Linux systems, and it is always my first port of call when I'm invited in to clean up after a breakin.

    Plug in a hub (so all traffic can be seen by multiple machines - a switch ain't as good, unless it has a monitoring port) in front of the machine(s) and run tcpdump or ethereal on another system to watch traffic from the machine. This will let you watch exactly what traffic is happening on those weird ports, or watch outbound SMTP traffic for spammer activity.

    We don't put Windows-based systems on the internet, partly for security reasons, and partly because we don't have any Windows specialists, so I can't help for on-the-box detection there, although I would expect a commercial virus scanner should find everything.

    • by ManxStef (469602) on Saturday June 26, 2004 @10:39AM (#9536926) Homepage
      Another good rootkit checker, which seems to have a more active development cycle, is Rootkit Hunter [rootkit.nl]. Here's a Newsforge article on it [newsforge.com], with a few more details.

      A few other comments:

      Virus scanners won't help on jot against a custom hack (as Valve found out, for instance). They can be helpful, but don't put full reliance on them.

      Running an Intrustion Detection/Prevention System such as Snort, Samhain, Prelude, etc. will help you manage the monitoring side of things; more than a few machines becomes a pain without additional help. Also take a look centralising all your logs on a syslogng server or something similar, if you don't already (note that there are various solutions out there to get Windows boxes to log to a syslog server).

      A honeypot may distract the hacker from your production servers for long enough for you to identify that there's a problem.

      Also take a look at "HoneyTokens": specifically created database records that trigger alarms if they're accessed - usually high profile fictious targets that would make excellent trophy hacks - there's more info on this over at SecurityFocus [securityfocus.com].

      If you suspect that a machine has been compromised, as other have said, the ONLY WAY TO BE SURE is to rebuild the box from scratch. While this may be a real pain, hopefully it'll help you get the procedures in place to make this as painless as possible, so it's not all bad.

      Perform security audits/pentests every now and again. Tools like Nessus [nessus.org] help: here's a good series on using Nessus [securityfocus.com] (part 2 [securityfocus.com], part 3 [securityfocus.com]).

      Get familiar with security tools such as the top 75 recommendations at Insecure.org [insecure.org] (home of Nmap).

      Remember that security is a PROCESS, so be thorough; get an entire plan together and cover all the bases that you can, taking special care to identify and cover the weak points. Your company's security is only as good as its weakest link; for instance, priviledge escalation of weak user account passwords is a good one.

      Read SecurityFocus [securityfocus.com], PacketStorm [packetstormsecurity.org], CERT [cert.org] and the like, and try to get involved in their communities; they can be invaluable! They're also got a lot of good tutorials, such as how to lock down Apache, IIS; securing PHP, ASP; etc.
  • I was looking into ways of approaching this type of problem, and it seems that a good firewall monitoring solution could help. One I came across is made by OnGarde [ongarde.com]. They run a service that allows deep inspection of traffic, and they support alot of devices.
  • by Korgan (101803) on Friday June 25, 2004 @09:06PM (#9534039) Homepage
    First thing you are going to want before you can go to the boss and shove it up his nose is proof. Put a machine on a monitor port of the switch right beside the egress point of the firewall and sniff away. You know what sort of traffic should be going out so you can filter a lot of that out. You also know that given you're hosting sites, most of your connections are going to be originated from the outside, coming in. So filter those out and look for connections from the inside going out.

    Ultimately you're going to need to build up some pretty decent filters or you'll just overwhelm the machine doing the sniffing, but if you know what traffic should look like going across your firewall, you can look for the anomalies quite easily.

    Probably the easiest way for you to do this would be to use something like Snort with some pretty decent rules. The downside to IDS is that it takes a lot of effort to get the rules setup properly for your network, but that could easily be done in your spare time, off the clock as it were.

    Virus scanners aren't always the best solution to finding back doors and such. On Windows there sure to be malware out there that just hasn't been noticed yet because it doesn't do anything overtly "virus-like". Trojans and malware like NetBus or BackOrifice (to use two very well known examples) are easily altered to hide from many AV apps (just that no one bothers anymore).

    Because of this, any machine you think is compromised should be rebuilt and patched up from scratch. Once you've got it rebuilt, and before you put it back on the network, use Tripwire (or even a shell script) to take a baseline MD5 hash of every single windows and application file on your harddrive. This has two advantages. 1) You build up a list of known good files on your machine. 2) It becomes easy to spot new/added files and investigate them. You can do this on any platform, *nix or Windows.

    To get the evidence you want though, you're going to need to use tcpdump/snort/ethereal (or any other sniffer you are comfortable with) to prove there is traffic going across your [firewall|egress routers] that shouldn't be.
    • In case you didn't know, that's not a Voltaire quote. It's a description of Voltaire's beliefs, as written by Evelyn Beatrice Hall in "Friends of Voltaire".
      • A little research on Hall has turned up...

        ----8----
        Hall herself claimed later that she had been paraphrasing Voltaire's words in his Essay on Tolerance:

        "Think for yourselves and let others enjoy the privilege to do so too."

        Hall died in 1919.

        In his A Book of French Quotations (1963), Norbert Guterman suggested that the probable source for the quotation was a line in a 6 February 1770 letter to M. le Riche: "Monsieur l'abbé, I detest what you write, but I would give my life to make it possible f
  • but our other servers show many signs of possibly being compromised including unexplained outgoing traffic, ... strange ports being open...

    Perhaps I'm being naive, but what's preventing you from using 'netstat', 'nmap -sV', and plain old 'netcat' to figure out what the strange ports are doing?

    • just for one - any binary on your victim machine has a possibility of being compromised... so netstat data would be questionable.

      but nmap and netcat would be fine. from elsewhere. maybe nessus too, while you're at the old security console.

    • In a word, rootkits [tech-faq.com].

      In theory, once a root-level compromise has occurred, you can trust nothing a computer says anymore. Crackers have, through steady effort, made that almost 100% true, and if they aren't there already, they don't have far to go.

      No binary can be trusted on a hacked system.

      For the curious, I recomend Googling "rootkit"; there are a lot of helpful resources out there.
  • by imsmith (239784) on Friday June 25, 2004 @09:11PM (#9534059)
    There are stories just now breaking into the general consciousness of IIS servers that have been compromised for months and feeding executable code tacked on the end of http calls to IE and spreading malicious code and feeding something (reports and opinions vary) to servers in Russia (also with varying opinions as to the owners - organized crime seems to be the evil de jour).

    These compromised IIS servers often have the server attached to the explorer.exe process and are therefore not detectable by virus scans. Using netstat or filemon you can find the open ports. The only solution is a bare-metal rebuild.

    Have fun if that is what you are dealing with.

    As an aside, if this company is unconcerned about the compromise of credit card information you might want to find a new place to hang your hat. The civil and criminal liabilities are pretty steep for the compromise of financial transaction information (if you are in the U.S.) and they extend to individuals inside the company, not just the board and officers.
    • What you say is excellent, I wouldn't have thought of that.

      But by posting this question to /., and by being able to show a record of his attempts at fixing the problem, he should be off the hook. He can point to this story as a time-stamped description of his stopped efforts. The the blame would shift to his boss.

      But I could be wrong.

      • Heh. You don't work with any lawyers do you? Posting a question to Slashdot is not even remotely close to due dilligence or evidence of a conversation between him and a third party.
      • But by posting this question to /., and by being able to show a record of his attempts at fixing the problem, he should be off the hook. He can point to this story as a time-stamped description of his stopped efforts. The the blame would shift to his boss.

        I am not a lawyer, but I play one on Slashdot!

        But I could be wrong.

        Yup.

    • >varying opinions as to the owners - organized crime seems to be the evil de jour

      If they're in Russia, and making money illegally, and not owned by organized crime -- they will be soon.
  • by FFFish (7567) on Friday June 25, 2004 @09:13PM (#9534066) Homepage
    ...post the IP address here, and I'm quite certain your worst fears will be so perfectly confirmed that your boss will have no choice but to admit you were right!
  • Hire an expert. (Score:4, Insightful)

    by ajayrockrock (110281) on Friday June 25, 2004 @09:13PM (#9534068) Homepage
    Listen to your boss and do what you do best, web programming. But convince him to get an outside security consultant to scan your network for problems and then listen to their advice.

    My company has an outside security company run quarterly checks against our network, and they sometimes catch stuff that I miss. Just don't let them talk you into buying a over-priced checkpoint firewall when all you need is a Linux box and Iptables.

    --Ajay
    • Don't just recommend this to your boss in a conversation. Write him a memo (yeah.. the paper kind.. remember those?) In it explain why you think systems are still compromised and that all of your customers' data (possibly including credit card and more) may be at risk.

      Just make sure that if he does nothing it is clear that he was warned and that you tried to do the right thing. Then make a copy of the memo for yourself before giving it to him.

      Finally, follow your boss's orders and get back to web progr
  • Do your job? (Score:5, Insightful)

    by legLess (127550) on Friday June 25, 2004 @09:16PM (#9534081) Journal
    Quoth the poster:
    I think we are possibly providing hosting for undetectable spammers but the boss thinks I'm paranoid, and says that I need to be working on paying work, not security. Has anybody else been in this situation? How can I detect these guys if their tools don't show in virus scans?
    Not to be a dick, but did you miss the part where you got clear directions from your boss not to try to "detect these guys?" It seems like you identified a problem, brought it to management, and they told you to ignore it. Sounds like you need to decide if you want to be an employed web programmer or an unemployed security consultant.
    • Re:Do your job? (Score:4, Insightful)

      by ehetzner (94010) on Friday June 25, 2004 @09:39PM (#9534202)
      Not to be a dick, but did you miss that part in life that went something like this: you were right, boss was wrong, shit hit the fan, you got blamed? That is standard operating procedure, and if you don't look out for it, you're going to be the one in trouble.
      • Re:Do your job? (Score:3, Insightful)

        by legLess (127550)
        That's certainly true, but he's obviously made his boss aware of the problem (in writing, if he has any brains), so he seems fairly well covered. If the organization's so broken that it would nail him in the face of evidence that he tried to fix the problem and his boss told him to get stuffed, well, he's fucked no matter what.
  • by ezraekman (650090) on Friday June 25, 2004 @09:28PM (#9534145) Homepage
    I warned them that they needed to improve their security, but was ignored until a hacker kindly emailed them proof that their credit-card server was compromised, and the Sasser Worm took us offline.

    You're already doing your job, and not being listened to. Since I'm not a sysadmin, I've got no direct advice for you regarding the tracking of such activity. However, it seems to me that this is the smaller of two problems. The first is being able to do your job from a technical perspective. The second (and it seems, more immediate) problem is being able to do your job from a political perspective.

    Your boss has already watched his public facing site(s) and servers go down due to his failure to listen to you. Now it sounds like he's about to make the same fatal mistake. This, of course, places you in the lovely position of having to remind him that he's about to make another major tactical error... but you also have to do so in as subtle manner as possible, so it doesn't sound like a recrimination. All I can suggest is to try to make it blatantly obvious to him without coming out and saying it, thus giving him the opportunity to "discover" his error and correct it on his own.

    One other suggestion: document, document, DOCUMENT! Make sure that you can prove later (should it be necessary) that you did everything you could. This is another area of vital importance for your job security that also must be done very carefully. Simply CCing the higher-ups will likely piss off your boss (and possibly the folks you're CCing as well), and may look like unnecessary whistle-blowing or complaining. Do it as unobtrusively as possible, but make sure that you're covered, in case there's any question later.

    One possible solution to both problems is to communicate all of your concerns in an e-mail. Write it during your lunch hour, so he can't get upset at you for "wasting" more company time on it. Make it clear exactly why you think there is an issue, and mention (if you can do so gently and without provoking him) the past incident. Remember that if you want someone to do something, you shouldn't tell them why *you* want them to do it. They don't care about what you want. Tell them why *they* want to do it. Best-case scenario, he listens. Worst-case scenario, he gets a little more annoyed at you, but you've got your documentation.

    I don't envy your position, and wish you luck.

  • Run, don't walk. (Score:5, Insightful)

    by gaudior (113467) on Friday June 25, 2004 @09:39PM (#9534203) Homepage
    Get your resume up to date, and get moving. This outfit clearly has no real concern for security, but since you've started poking around, asking questions, and raising hell, you are the messenger that gets shot when the company really does start to take security seriously, if they ever do.

    On the other hand, if they continue as they are, they may not survive, and you are screwed again.
    • Have you worked in the US? They are already outsourcing jobs, do you seriously think he should quit to find the magical place you call a "company" that takes security seriously? Where is this place? Do they pay well? Company executives have a responsibility to focus on their core business, making a profit, etc., most started working before the letter "e" was prepended to every word in the language, and don't even know what the internet is, much less how important security is. They know buzzwords, somet
  • Watch out (Score:4, Interesting)

    by schmaltz (70977) on Friday June 25, 2004 @09:55PM (#9534281)
    Since you're asking "how do I disinfect these boxes" (essentially), you make it pretty clear you don't already know how. You could download Nessus and chkrootkit, and maybe get lucky - e.g. the cracker who's built a nest inside your server doesn't detect your attempts to detect him.

    The worst case scenario here is that you detect a problem, attempt to fix it yourself, and trigger Something Bad[tm] in the process: the cracker retaliates, or you break a working app because you upgraded something out-of-sync with glibc (or whatever), or you otherwise become the catalyst for noticeable downtime that will piss off your boss and get you fired, or worse - they turn you into a scapegoat (see the Intel case against that security chap.)

    Just make sure you cover your ass. You've notified your boss, copy those emails to a nice safe place (headers and all), and don't do anything stupid.

    Best scenario is to build a fresh box, backup the old box's data, restore it to the new box (clean! no code! only data!) Don't bother trying to salvage a compromised O/S installation. Too many things to miss. And, when you're building fresh, don't ssh via one of the infected boxes! Don't inadvertently give *any* info to the crackers that you're setting up a new machine. Better yet, build it with the ethernet cable unplugged, if possible. Do it from CDs.
  • Anyways, the subject says it all. Its very possible that you have been comprimised if your kernel is panicing. I think its time to boot from a safe copy of your distro (or some other custom distro...etc) and confirm the checksums of everything and do a good scan of the filesystems.

    Also, one good thing to do is place a clean box in between the comprimised server and its internet connect and run tcpdump/tethereal on the brided connection. The first thing you need to do is be able to identify _all_ traffic go
  • by mnmn (145599) on Friday June 25, 2004 @10:22PM (#9534418) Homepage
    All you have to do is stand straight and announce that we've been 'hacked'. If they ask to what extent, how bad etc, just say we've completely been hacked. Its all gone.

    You'll be given all the time and budget to fix it. FUD doesnt always require proof, unless someone calls in some consultant.
  • think we are possibly providing hosting for undetectable spammers but the boss thinks I'm paranoid, and says that I need to be working on paying work, not security.

    You've got a money hemorrage on your servers. Don't bother trying to talk sense to your boss, just strengthen up your arms and be read to jump ship and swim when the next boat comes along. Start shopping your resume now, and remember: when everyone is out to get you, paranoia is just good sense.

  • Honestly letting a credit card server be comprimised and not doing anything about it until it becomes urgent. Then ignoring more possible exploits? If I was a customer I would be might pissed. Buy something from your company and then go get you a lawyer.
    • There are a *lot* of companies out there with that kind of attitude. A hacked server is not seen as a problem unless it's immediately noticable - that is, the page has been defaced or the machine has gone down completely. If you can't see the problem, people will tend to ignore it.

      And therein lies the problem. As a consumer, there are thousands of companies I could buy from online, but as long as security is given such low priority, how can I trust any of them?
  • ...but was ignored until a hacker kindly emailed them proof that their credit-card server was compromised.....and says that I need to be working on paying work, not security.....

    Tell him that keeping your servers secure IS paying work. As a customer, if I know that a company is not keeping my credit cards, etc. secure, I will not do business with them. Ask him what would happen if there was a big 'scandal' (for lack of better terms), and thousands of customers credit was exploited. How much of an opp
  • by Anonymous Coward
    While my situation isn't *exactly* similar, I am interested in people's thoughts...Here goes:

    At my job, I am one of two web developers. Besides us, there are the two owners and our systems admin. The owners want to become a viable commercial hosting service with secure storefronts, etc. Fine says me.

    The problem lies in that one of the two owners (The husband) is a pig-headed idiot. Recently he asked us to implement a RAID solution for the webserver (notice the lack of an 's' at the end of webserver).

    • I worked for a guy like that once. I was job-hopping and this guy had big ideas, and the price was right. However, I was the *sole* IT/Programmer/Webmaster/Network Analyst/etc guy.. after about 2 months of him telling me that because he made his fortune in Metalworking, he knew more about computers than I did, I hopped away.

      What I'm actually surprised at is that three established guys (for which you say have 40+ years of experience between you.. hope you're not counting high school computer classes :P) are
    • He's paying you. So you're sort of obligated to tolerate him. Occasionally my boss buys unusual things but never like that. The best you can do is to educate him and do a good job despite his mistakes.

      Maybe ask for an IT budget whereby you and the others get a fixed amount of cash to spend on hardware, since he's obviously paranoid about spending (forgetting that he pays you tons more to deal with the crap he buys) and wants to avoid getting something more expensive than it needs to be, and you want to avo
    • Re:data managers (Score:3, Insightful)

      by bfg9000 (726447)
      I've seen situations like this in the past many times, especially in smaller companies where the boss started it and built it up by himself and feels the need to micro-manage.

      What I said to one guy like that is "Sir, we respect you and will do whatever you want us to do here, because you're the boss and it's your company, but you hired us to take the load off you so you'd be able to do less work and make more money. Trust us to do a good job and we will. We might not do everything exactly the same as you w
    • You can't help everyone. If your boss doesn't respect what you have to offer then sooner or later you are going to get fired.

      The longer you stay under these conditions the worse your reputation will be. The money you are making had better be enough to cover personal attacks on you by your boss that may haunt you in the future.

  • you need to nuke and Pave the OS's sumultainiously if possible, and restore data from a trusted backup if you have it, otherwise notify customers that THEY need to restore from THEIR backup (they do backup their data right?).

  • Forget running ethereal or other packet sniffers, they're far too fine-grained for what you're trying to do: prove they're being abused.

    Connect a small box running your favorite *nix running ntop [ntop.org] to the service port (or whatever they call it, I'm half asleep) of the switch/router to which the box(es) in question are connected.

    That's it.

    Ntop will give you very nice graphs to print out for the guy who needs a clue, showing not only the IPs involved, but the ports, percentages of traffic per protocal/port/w
  • Security is paying work, unless your company has a reputation without worth. You can get that sentiment out of any of the good security books out there, but saddly management can only see the spending cycle, not the averted crash-burn-patch-fix cycle. Remind him that if we were all "paranoid" to begin with, we wouldn't have had a hacker tell us to patch our stuff. What if the hacker didn't like you so much?

    Security really isn't a game or a buzz word. Folks have to own that concept, not just parrot it.

  • I was in a very similar situation awhile back when the call center I worked for had some major internal and external network security issues. When I initially stumbled apon this I emailed the IT dept explaining the issue and I was quickily brushed off and told it wasn't an issue. Not being satisfied with that I dug a little deeper and was fired for it. They ended up making wild accusations regarding my intentions etc etc.

    So my best advise to you is that if it's not in your job description, leave it the fuc
    • I couldn't agree more.

      If you find a problem, whether it's security or something else, notify the appropriate people (CC your boss). If they chose not to fix it, that's their problem. At least your a** will be clean if/when there's legal action resulting from the issue.


  • ... Snort! [snort.org] Faster than a speeding packet, more powerful than a trojan, able to detect small intrusions with a single cycle.

    But seriously, get a Snort box installed and be more active(*) in your intrusion detection. Surely your boss can't object if you slap down a printed snort long on his desk, and show him proof of intrusion.

    dave

    (*) I absolutely refuse to use the word 'proactive'. I'm not playing buzzword bingo here.
  • It's the only way to be sure.
  • I've seen all the usual goodies mentioned (Ethereal, tcpdump, nmap, nessus) but I found when it comes to detecting a virus infection I find Etherape [sourceforge.net] impossible to beat.

    The main reason for that is that etherape actually maps out live traffic patterns (and volume) on a network. I personally am quite surprised it's not a default part of more security bootdisks. You'll spot an infection straightaway as they tend to 'broadcast' on the network.

    As for protection, host checksumming has one disadvantage: it's AFT
  • lol, heyyy share your server with us! i want some 0days hahahaha

Never test for an error condition you don't know how to handle. -- Steinbach

Working...