|
In regards to the following:
There apparently seems to be a bunch of redhat server being backdoored via a library. Does anyone have advice on how to track and find the initial breach of contact? |
||||
|
|
|
In that specific case, as far as I understand, the initial compromise was traced back to a compromised system at cPanel. The breach allowed the indirect attack of some systems which use cPanel, and the attacker was on the habit of installing a rootkit which put a backdoor in SSH. The general methodology for understanding what happened and whodunnit is the same as in any case of post mortem debug: gather data & think hard. If many machines were compromised, try to work out what they have in common. Inspect all log files. Take a byte-to-byte image of the hard disk of an affected machine and see if there are interesting things in deleted files (most attackers will cover their tracks by deleting temporary files they used, but few will bother to actually fill the corresponding disk areas with zeros). This is called forensics and it is an expertise in its own right. |
|||
|
|
|
I believe a good hids or aplication layer firewall can cut your response time otherwise required in deep analysis like forensics. I also believe in case of complicated attack no one box forensics is enough depending the scope of investigation all the systems included network devices , dns and redundant servers be put for the same. Sometimes clues are left at place where you least expect. You can only tell or follow the path of distruction if you got controls at required levels.Without complete controls point you would never know where the attack originated e.g disgruntled employee through server vlan is one. There is one big difference related to outcome of performing forensics when you are doing on dead and dried computer versus a system with complete auditing enable and on top runs just the software to control such violations. The artifacts are plenty in the latter case. |
||||
|
|
