Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
Date: Mon Sep 29 2008 - 16:40:30 CDT
On Mon, 29 Sep 2008 21:44:22 BST, Kyrian said:
> > A message left by him on a system:
> Changing the /etc/motd file or equivalent is hardly costly, and hardly
> massive damage, no? Hypothetically speaking, if I wanted to do as little
> damage as possible and make someone get the message I'd been in there,
> that's probably what I'd do.
Look at it from the other end. You logon one day, and find that person or
persons unknown have screwed with your /etc/motd file.
Question 1: How long does it take you to *confirm* that the /etc/motd change
was the only thing screwed with on the system, and that you don't have *any*
other files that were inappropriately accessed and/or modified? Remember in
your analysis to allow for files that were modified and backdoored, then
the backdoored versions are in your backup system - and then the hacker puts
the unmodified versions back. If you have to restore that file, you've just
brought a backdoor onto your system...
Question 2: At your current pay *plus overhead* in <local monetary units>/hour
(assuming you're actually employed), how much does the answer to Question 1 end
For instance - if it takes you 5 hours to *prove* that nothing else on the
server has been messed around with (consider the fact that on most servers,
you can't just do a 'find / -newer /known/good/timestamp' because you'll drown
in false-positives). If your salary is $20/hour and overhead (benefits, cost
of office space, work computers, electricity, etc) is $10/hour, that little
escapade just cost your company $600.
Oh yeah - if you decide to take the server down so the normal production
workload doesn't make the analysis intractable, you get to redo your answer to
Question 2 and also add in the cost of all the employees that just got idled
because the data they needed just became unavailable.
Unless your site has the policy "screw it, I'll just either ignore it and do nothing
at all, or just re-image and forget it ever happened", incidents where
"only one file got modified" become very costly very quickly.
Go re-read Cliff Stoll's "The Cuckoo's Egg" - *that* whole story started off
because of a $0.50 discrepancy in an accounting run. Just because it looks
trivial and ignorable rarely means it actually is.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001
-----END PGP SIGNATURE-----
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/