5

Looking for a formula and parameters to feed it that will aid in the isolation of relationships within a system when the origin and cause of an exploit within it is unknown. Here's an example of an attack where the vector(s) are unknown, but there is an awareness of the exploit's occurrence: Verifying that I have fully removed a WordPress hack?

4
  • 3
    Can you expand further on what you mean by formula - I don't understand your question. Perhaps an example?
    – Rory Alsop
    Jun 10, 2011 at 23:48
  • @Rory Alsop: Well since I've already given an example, I'll stick to it. A wordpress site had HTML inserted into the homepage, there is ZERO trace of how it got there, how would you backtrack from that asset to it's access points to zones beyond control, including the possible conclusion that those zones maybe that source of the attack, and that there is no countermeasure for that threat zone; in thing case, the site's on a shared server, which is not 100% in control of the site itself. Just seems to me, basic problem is if there no logs, how to you traces vectors of the known exploits.
    – blunders
    Jun 11, 2011 at 3:19
  • Example understood, but what do you mean by formula here?
    – AviD
    Jun 11, 2011 at 21:54
  • @Avid: A systematic approach with expected inputs and outputs, but any method is fine.
    – blunders
    Jun 11, 2011 at 22:59

1 Answer 1

4

If you have zero trace of what happened then you can only make assumptions as to what happened.

Standard practice is to identify all platforms and versions, then to look at vulnerability databases to see if there are known weaknesses in your environment.

Then look at all information flows and transforms - identifying entrance points.

The above are common initial steps in identifying vulnerabilities, but I don't understand what your question means regarding isolating relationships etc.

Hope this helps.

3
  • Nice work in providing concrete actions and standard practice.
    – this.josh
    Jun 11, 2011 at 18:44
  • +1 @Rory Alsop: The intent of isolating relationships in to limit the scope of analysis to the attack.
    – blunders
    Jun 11, 2011 at 23:10
  • So by isolating relationships you mean identifying information flows and connections?
    – Rory Alsop
    Jun 12, 2011 at 16:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .