Tag Info

New answers tagged

0

Thanks for all support. These have been my findings after a thorough investigation: The ownership for both scripts found in /tmp has been the Apache user. The /tmp directory is writable by Apache. I compared the creation date with any relevant log and I found in the Apache logs how they entered in the system. It turns out that they exploited the magento ...


1

Seeing some answer in another site thinks not using the root account increases security, I'm posting this. With the default timeout settings, there is an easy way to gain root privileges by adding this line in .bashrc: trap 'sudo -S touch /hacked </dev/null 2>/dev/null' debug It will create a file hacked in the root directory once the user has used ...


2

The course of action is to wipe the machine and install everything from the stored image or from scratch. It's just too hard to be confident that you've cleaned them. Especially once the attacker has gotten root access.


0

I get the same. Sounds like a false positive. Now since I knew that the RKhunter program is just a script, it seemed reasonable NOT to panic, since such scripts generally lack the sophisticated heuristics needed to correctly filter false-positives. A quick check of the RKhunter rootkit “/var/log/rkhunter.log” log-file revealed the following: ...


1

There are many vectors. In one of my favorite videos from a certain security conference, a guy attacks a laptop running Ubuntu with a regular thumb drive (i.e. no hardware hacks) just by inserting the drive to the computer. Even though there was no autorun, there was automount and indexing. The drive contained a crafted JPEG file which used a flaw in the ...


1

Most of the infections come from computers where security is poorly managed so the autorun feature isn't disabled. Moreover, USB devices are inherently insecure as their firwmare can be rewritten for malicious intent. From SRLabs BadUSB: Reprogramming USB peripherals: To turn one device type into another, USB controller chips in peripherals need to be ...



Top 50 recent answers are included