Tag Info

New answers tagged

19

The commands themselves don't seem particularly concerning - they're a few random-looking searches for particular substrings. However, if your shell history has unexplainable entries, that's a sign that you've been hacked. At this point, what I would recommend is to check your SSH logs to find out when this occurred (and from what IP), and secure your ...


16

It's several text searches. The first one searches for update.creditcard (the dot is a any-single-character wildcard) across all subfolders. (More detail about grep -rnw on StackOverflow.) And if you or another admin didn't run these commands then I'd be very worried and wipe and reinstall that server. The searches themselves are harmless. But if anybody ...


2

Let's look at how such a thing might play out: A classic example is the Dual-EC DRBG which employees a back-doored RNG to create a general attack against TLS. The other half of this attack beyond the vulnerable RNG is a mechanism for revealing to the attacker the state of the RNG at the time of use to allow the attacker to predict the remaining "random" ...


1

There are some classes of PRNG weaknesses which require the attacker to obtain multiple numbers in order to predict the next number in the sequence. Using two PRNGs would compartmentalise the risk, in the event the "public" chain can be predicted, the "secret" numbers may still be unpredictable. Honestly I wouldn't consider it that significant but it could ...



Top 50 recent answers are included