Forensics On a Cracked Linux Server

This blog entry is the step-by-step process that one administrator followed to figure out what was going on with a cracked Linux server. It's quite interesting to me, since I have had the exact same problem (a misbehaving ls -h command) on a development server quite a while back. As it turns out, my server was cracked, maybe with the same tool, and this analysis is much more thorough than the one I was able to do at the time. If you've ever wondered how to diagnose a Linux server that has been hijacked, this short article is a good starting point.

Comments

Yeah obvious FUD article

[Anonymous Coward]

Why Slashdot would such obvious anti-Linux FUD is beyond me. Maybe the M$ advertising dollars are turning their heads.

The bottom line is that a LINUX SERVER CAN'T BE CRACKED.

Maybe this admin got his login info phished by Nigerian scammers, I don't know. The guy probably is wondering why his Ebay account has a bunch of negative feedback and his MySpace is all jacked up and hasn't put 2 and 2 together with that time he responsed to that clever email asking for the triple whammy of MySpace/Ebay/root on your servers so that you could clear the money transfer.

That or he didn't have his updates turned on and had an outdated BIND. And its not like BIND means Linux is unsecure.

Even not that the idea that Linux is crackable is laughable and not worht front page at digg let alone slashdot. You don;t see Technorait or Bruce Perens' site posting garbage like this ever so why slashdot editors can't see thru it i dont kno.

Re:Yeah obvious FUD article

[ATMD]

*whoosh*

Re:Yeah obvious FUD article

[Anonymous Coward]

. o <- Joke

..O <- You
./|\
./ \

Re:Yeah obvious FUD article

[suggsjc]

Dang HTML Formatted default, forgot the <br>'s

ASCII art is lame
If you really want to blast them
Then try a haiku

So in my rage, I wrote this (and used the code layout):
Today I posted
Today I looked like an ass
It is Friday, beer

Meta-cracking

[CopaceticOpus]

Oh, I see, it's a clever DOS attack:

1. Infect Linux server of some guy with a blog.
2. Guy blogs about how he dealt with said infection.
3. Blog posting gets linked to on Slashdot.
4. Millions of computers attempt to access the blog, hence bringing down the server.

Don't you see? We've a socially engineered botnet!

(And please, for the love of all that is sacred and funny, don't reply to this and add steps for "???" and "Profit". It's just tired and completely not funny. And the clever little variation on that theme you're thinking about posting right now isn't funny either.)

Re:Meta-cracking

[Anonymous Coward]

1. Find clever little variation that is funny
2. ????
3. Profit!

Raise your hand

[tie_guy_matt]

Raise your hand if you typed "ls -h" on your box just to make sure it still works right.

Re:Raise your hand

[Anonymous Coward]

C:\>ls -h
'ls' is not recognized as an internal or external command,
operable program or batch file.

Oh noes!

Re:Forensics

[Anonymous Coward]

On the one server I have backdoor access to .bash_history is symbolically linked to /dev/random

It makes for an interesting read :)

Anonymous in case the admin actually reads slashdot.

Re:Ssshhh.... Secrets Revealed...

[dedazo]

I am a MS insider

The 220,000 or so members of the Slashdot Members Who Post Authoritative Statements On The Inner Workings Of Microsoft To Support Their Arguments warmly welcomes you to the club.