Re: one of my servers has been compromized

[Gage Bystrom <themadichib0d () gmail com>]

My bad, should have said that you can't trust the md5sum tampering(since
you stated to have a static copy on the flash drive) but you couldn't trust
it since you couldn't trust the system calls.

The immediate moment you have to worry about a legit userland rootkit you
have to worry about a kernel rootkit. After all you have to consider the
psychology of the attacker. If you were to compromise a box, and cared
enough to hide a backdoor they cannot detect without static, write proof
media, then you care enough to go the extra step for a kernel rootkit.
Otherwise you would be spending even more time and effort to make your
userland kit work to satisfaction for a far weaker hold on the box. It
would simply be idiotic. And I think we can all agree that an attacker able
to do either of the above is not an idiot.

On Dec 6, 2011 10:19 AM, "Paul Schmehl" <pschmehl_lists () tx rr com> wrote:
> A "poor man's" root kit detector is to take md5sums of critical system
binaries (you'd have to redo these after patching), and keep the list on an
inaccessible media (such as a thumb drive).  If you think the system is
compromised, run md5sum against those files, and you will quickly know. You
could even keep statically compiled copies on the thumb drive to use in an
investigation.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/