0

I am investigating a data breach in the company I work for. Seems that the intruders managed to access a server from the internal network by compromising a router witch supports PPTP vpn and using this router as a pivot to the server.

Obviously the logs of the router had been cleared.

Could I some how recover the deleted logs ?

I must mention that the router is an asus rt n53 and had a weak password.

Thanks

closed as off-topic by schroeder, Xander, Mark, Adi, Rory Alsop Dec 18 '14 at 8:20

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder, Xander, Mark, Adi, Rory Alsop
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    This is a question for Asus support. This situation is typically why you need to ship your logs to a secure repo. – schroeder Dec 17 '14 at 22:38
  • Agreed with Schroeder. Aside from that I think it will be really hard and expensive – Lucas Kauffman Dec 17 '14 at 23:50
2

Asus uses ASUSWRT which can be decompiled, modified, etc. but as for data removal, once it's gone, it's gone. I can't see anyone in the forensics field willing to give the time of day to perform any forensics work on a SoHo router, so you would be wasting a lof of time. If you have telnet access, you can try checking your backup logs (in the event you didn't know they existed) if you're running the Merlin firmware. The backups are stored at /jffs/syslog.log ... If you are not running Merlin, you can upgrade your router firmware, or configure a syslog server, and have your router send logs there. Common rule of thumb... Change passwords to something extremely strong especially at your main point of entry

EDITED:

"I can't see anyone in the forensics field willing to give the time of day to perform any forensics work on a SoHo router" The cost of going through the motions of performing a forensics/data recovery would be very expensive. Based on the type of router you mentioned, one can infer that it is used in a small business, which likely means, the this business is less likely to fork over thousands of dollars for the analysis, and or recovery. Forensics is not cheap, and it is not a quick process.

Not the answer you're looking for? Browse other questions tagged or ask your own question.