Last week I had a linux debian distribution accessible from Internet compromised through SSH for 24 hours. As far as I know the attacker could get root privileges and performed some malicious actions.

The attacker deleted the .bash_history file, the entire /var/log folder and rebooted the machine.

I've been trying to recover inodes from deleted logs but debugfs does not show results. The command "last" does not show as log file was deleted. The file "/var/log/auth.log" was deleted as well (as I said, entire /var/log directory was deleted).

Don't know where to look as this is a standard distribution with no additional packages installed, as almost all tools uses /var/log folder for storing that kind of information. Any ideas?

  • Try mounting HDD on another computer and try recovery of whatever you can uncover. It's important that you assume that entire sensitive information on that disk is compromised. If you can, clone the hard disk on another drive so that you have another copy, before performing any action on it. Dec 25 '15 at 18:55
  • recovering files methods with linux depends on the partition type , please edit your post and specify what partition type you are using
    – Sarastro
    Dec 25 '15 at 18:59
  • 1
    Why are you trying to audit logins? What info are you trying to get? Dec 25 '15 at 19:22
  • @Neil Smithline Want to know who gained the access to the machine. -Sarastro sorry I forgot to say it's an EXT4 partition. -K.P. I just tought that but trying some recovery tools I recovered too many mp3s corrupted, and it has not sense as that machine had no music. Dec 26 '15 at 0:24
  • 3
    The mp3 you recovered were used to stuff your disk freed space with irrelevant data. This is a fast "shreder" of the poor.
    – dan
    Dec 26 '15 at 12:11

Your best bet is searching for "forensic data recovery linux" and going from there. Keep in mind, though, that if the attacker was any good, they probably didn't just delete the logs, but used a tool like "shred" that specifically makes file recovery near-impossible (or at least very expensive).

There isn't that much useful info you can get from those logs, though. You can probably find an IP used to launch the attack, but you'll most likely trace it back to a TOR exit node.

For the future, one of the best things you can do is set up a hardened network syslog server that would collect syslog data from your Internet-facing systems. This will allow you to analyse your log data even if your local logs have been deleted.

  • That's I think, the attacker may have used some tools for deleting the files in a permanent way but any consideration would be good to know. Dec 26 '15 at 0:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.