Timeline for How do I deal with a compromised server?
Current License: CC BY-SA 3.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 15, 2018 at 9:14 | comment | added | Stilez | Upvoting to offset downvotes - this might not explain all steps fully or be easy for a layperson to follow, but it's succinct and basically correct. | |
| Sep 19, 2016 at 14:50 | comment | added | Tim Seed | @DrunkenCodeMonkey thank you !! Having had to deal with 3 servers that have been hacked in a 30 year IT career, the advice I gave was based on experience not some 10-minute "Anti Hazker" flash/powerpoint demo. Once a hacker is in - you have no idea at all what they have done to your system - added new ssh port, new accounts, new shares, changed some subtle apache rules. Try finding something like that!!! Let them carry on with the possibly compromised server.... It will be their job not mine. | |
| Sep 17, 2016 at 16:56 | comment | added | Drunken Code Monkey | I don't understand why this has so many downvotes. This IS the best course of action. Just removing the malware does nothing. The malware wasn't there before and they still got in. Also expire all passwords on the network immediately, and monitor closely which users are changing them. | |
| Mar 10, 2016 at 4:17 | comment | added | Tim Seed | Imaging the drives would be the best option - sorry I did not explicitly say this. Forensic's is I agree a specialist skill - but if you do not take the time to find out how the hackers got in - and simply restore the system from yesterdays backup - Guess what ? They will be back - as you did not plug the gap. I was deliberately vague - as the reasons for the breech will vary so much - un-patched code, passwords, social eng, brute force, bad security model - the list is endless. "The taste of defeat has a richness of experience all its own." Bill Brady | |
| Mar 9, 2016 at 17:15 | comment | added | schroeder♦ | And then you need expertise in performing a forensic investigation (not a typical skillset for a server operator). "Ensure it does not happen again" is a very vague suggestion. This answer is a little light on actionable advice ... | |
| Mar 9, 2016 at 16:01 | comment | added | Mark Buffalo | Wouldn't it be better to image the drives, rather than backing up select files? Or, by "backing it all up," do you mean "image the drives"? | |
| Mar 9, 2016 at 15:59 | review | Low quality posts | |||
| Mar 9, 2016 at 17:17 | |||||
| Mar 9, 2016 at 15:42 | history | answered | Tim Seed | CC BY-SA 3.0 |