Hide it. Look for ways to "hide" your server , simple things such as using a VPN or change IPs
Ask HN: Anonymous person sent proof of SSH access to our production server
71–80 of 246 posts
Re: Ask HN: Anonymous person sent proof of SSH access to our production server
#72Try to "hide" your servers. Simple things such as vpn's and changuing ips
Re: Ask HN: Anonymous person sent proof of SSH access to our production server
#73This has been covered elsewhere (like on serverfault: http://serverfault.com/a/107346/2557 ) But it comes down to: - Take existing server down immediately. I'm assuming it is not on an isolated network -- so this should really be a priority. - Prep a new patched server (with a smaller attack surface and updated security credentials) - Postmortem the old box on an isolated network. Try to understand how the attacker g…
Also, you thank the reporter profusely for doing the right thing.
Ask for a BTC address and send a tip.
Re: Ask HN: Anonymous person sent proof of SSH access to our production server
#74Earlier quoted context omitted.
> where would be a good place to source security experts? There's no universal good answer for this. I spend a lot of time on ##crypto (irc.freenode.net), and a lot of smart folks hang out there. Some are very well connected to other security experts in their own isolated communities. However, there are undoubtedly silos of security expertise that remain untapped if you rely on just IRC. You could also find folks who…
It's the same concept as auditors, there's the big 4 that you've probably heard of, and a ton of other, smaller firms with varying quality. You could go with a known firm like iSec Partners, Matasano (now NCC) or Mitnick Security. They won't be cheap - at worst they may be able to refer you to some other reputable firm if your budget is limited.
> or Mitnick Security
Please no. Not Mitnick.
I'd rather funnel clients towards my competitors than Kevin Mitnick.
He's a skilled social engineer, and his greatest social engineering success was manipulating the media into believing he speaks for hackers in general.
He is not a programmer, his opinions on cryptography aren't insighful, etc. His only skill is deception.
Re: Ask HN: Anonymous person sent proof of SSH access to our production server
#75In terms of hardening against SSH attacks, the principles are quite simple. Your business case might mean that some of the following cannot be applied, but there's plenty of measures below that you can use to harden SSH. 1. firewall - only allow SSH connections from trusted static IPs 2. Use SSH keys then disable password logins. Lots of guides online to create keys, so I'll just cover the 2nd point: as root or sudo,…
Also, to get rid of 60% of the script kiddies, change the port to something high 1000+ (or even better 10000+). Its not a great option, but it does lower the amount of automated attacks that you get.
Re: Ask HN: Anonymous person sent proof of SSH access to our production server
#76In terms of hardening against SSH attacks, the principles are quite simple. Your business case might mean that some of the following cannot be applied, but there's plenty of measures below that you can use to harden SSH. 1. firewall - only allow SSH connections from trusted static IPs 2. Use SSH keys then disable password logins. Lots of guides online to create keys, so I'll just cover the 2nd point: as root or sudo,…
[deleted]
Re: Ask HN: Anonymous person sent proof of SSH access to our production server
#77Re: Ask HN: Anonymous person sent proof of SSH access to our production server
#78Earlier quoted context omitted.
Maybe hire that person?
Hire someone because they exploited a single vulnerability?
Maybe offering a reward is a good way to reduce the anonymity of the person, since rewards can be tracked.
Speaking only for myself.. If I were to go the trouble to anonymously tip somebody off about a security vulnerability, it would be because I cared that they were secure and that I did not wish to be identified. I would neither expect nor accept a reward.
Re: Ask HN: Anonymous person sent proof of SSH access to our production server
#79Thank the person. It wouldn't hurt to ask their suggestion. Enlist an expert on your team. Not every software developer is a system administrator and not every manager is an expert developer. YouTube videos doesn't make one an expert after a few hours.
I am certain you will receive very good advice here in the comments.
Technically speaking - you should give a little more data on your setup. A high level view would suffice. That way folks here can narrow their suggestions down.
Re: Ask HN: Anonymous person sent proof of SSH access to our production server
#80If your company got compromised, and your next step is to ask HN for advice, maybe your company should not be in business.