Quoting ME ([EMAIL PROTECTED]): [much really good advice, snipped]
> Weitse Venema and Dan Farmer gave a nice presentation on this and how > each choice excludes the other two. To a degree, yes. One might find it practical and quick to duplicate all hard drive contents to other media, preserving chain of evidence and maybe even leaving processes running on the compromised host. Which is of course a double-edged sword. But you can then do the rebuild on other hardware entirely -- if you have other hardware to work with, and have reason to go that route. > I came across this one and another article you had that provided links to > a variety of integrity checking apps. Pretty good information there. I > think we found one on your site too, and found that to be useful too. (Thanks.) You're probably referring to my old "Attacking Linux" article, http://security.itworld.com/4352/LWD000829hacking/pfindex.html . All of those pieces, plus my brief "system break-ins even without remote vulnerabilities" piece, talking about how an unnamed company's network was compromised because of stolen SSH credentials[1], can always be found linked from my personal page, http://linuxmafia.com/~rick/ . [1] That was when V[**COUGH] Systems was compromised because some idiot sysadmin in the IT Dept. SSHed out into a public Source[***COUGH***] shell server then _and ssh/scp'ed back in_. The latter blunder was fatal to company security, because he exposed vital security tokens on an exposed public machine that happened to have been rooted a short while before, because a user's tokens for access to _that_ machine happened to have been compromised on a university box. (No, said idiot sysadmin wasn't me, in case you're wondering. ;-> ) _______________________________________________ vox-tech mailing list [email protected] http://lists.lugod.org/mailman/listinfo/vox-tech
