On Mon, 29 Sep 2008 21:44:22 BST, Kyrian said: > > A message left by him on a system: > > > Changing the /etc/motd file or equivalent is hardly costly, and hardly > massive damage, no? Hypothetically speaking, if I wanted to do as little > damage as possible and make someone get the message I'd been in there, > that's probably what I'd do.
Look at it from the other end. You logon one day, and find that person or persons unknown have screwed with your /etc/motd file. Question 1: How long does it take you to *confirm* that the /etc/motd change was the only thing screwed with on the system, and that you don't have *any* other files that were inappropriately accessed and/or modified? Remember in your analysis to allow for files that were modified and backdoored, then the backdoored versions are in your backup system - and then the hacker puts the unmodified versions back. If you have to restore that file, you've just brought a backdoor onto your system... Question 2: At your current pay *plus overhead* in <local monetary units>/hour (assuming you're actually employed), how much does the answer to Question 1 end up costing? For instance - if it takes you 5 hours to *prove* that nothing else on the server has been messed around with (consider the fact that on most servers, you can't just do a 'find / -newer /known/good/timestamp' because you'll drown in false-positives). If your salary is $20/hour and overhead (benefits, cost of office space, work computers, electricity, etc) is $10/hour, that little escapade just cost your company $600. Oh yeah - if you decide to take the server down so the normal production workload doesn't make the analysis intractable, you get to redo your answer to Question 2 and also add in the cost of all the employees that just got idled because the data they needed just became unavailable. Unless your site has the policy "screw it, I'll just either ignore it and do nothing at all, or just re-image and forget it ever happened", incidents where "only one file got modified" become very costly very quickly. Go re-read Cliff Stoll's "The Cuckoo's Egg" - *that* whole story started off because of a $0.50 discrepancy in an accounting run. Just because it looks trivial and ignorable rarely means it actually is.
pgpdqUidsZILr.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
