Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: Supporters urge halt to, hacker's, extradition to US
From: Valdis.Kletnieks () vt edu
Date: Mon, 29 Sep 2008 17:40:30 -0400

On Mon, 29 Sep 2008 21:44:22 BST, Kyrian said:

  A message left by him on a system:
Changing the /etc/motd file or equivalent is hardly costly, and hardly 
massive damage, no? Hypothetically speaking, if I wanted to do as little 
damage as possible and make someone get the message I'd been in there, 
that's probably what I'd do.

Look at it from the other end.  You logon one day, and find that person or
persons unknown have screwed with your /etc/motd file.

Question 1: How long does it take you to *confirm* that the /etc/motd change
was the only thing screwed with on the system, and that you don't have *any*
other files that were inappropriately accessed and/or modified?  Remember in
your analysis to allow for files that were modified and backdoored, then
the backdoored versions are in your backup system - and then the hacker puts
the unmodified versions back.  If you have to restore that file, you've just
brought a backdoor onto your system...

Question 2: At your current pay *plus overhead* in <local monetary units>/hour
(assuming you're actually employed), how much does the answer to Question 1 end
up costing?

For instance - if it takes you 5 hours to *prove* that nothing else on the
server has been messed around with (consider the fact that on most servers,
you can't just do a 'find / -newer /known/good/timestamp' because you'll drown
in false-positives). If your salary is $20/hour and overhead (benefits, cost
of office space, work computers, electricity, etc) is $10/hour, that little
escapade just cost your company $600.

Oh yeah - if you decide to take the server down so the normal production
workload doesn't make the analysis intractable, you get to redo your answer to
Question 2 and also add in the cost of all the employees that just got idled
because the data they needed just became unavailable.

Unless your site has the policy "screw it, I'll just either ignore it and do nothing
at all, or just re-image and forget it ever happened", incidents where
"only one file got modified" become very costly very quickly.

Go re-read Cliff Stoll's "The Cuckoo's Egg" - *that* whole story started off
because of a $0.50 discrepancy in an accounting run.  Just because it looks
trivial and ignorable rarely means it actually is.

Attachment: _bin

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]