121–130 of 246 posts
Earlier quoted context omitted.
I assume he suggested asking them because Bitcoin isn't the only cryptocurrency.
I'm pretty sure the hacker won't want dogecoin or forked coin.
If it's just a nice kid you got lucky, and I would hire someone with a clue on security to thoroughly check your infrastructure at least once. But if it turns out to be a hook for something more nasty, you better get some serious help. Don't trust anything on that server anymore, and if you have other, similar servers running, suspect them to be compromised too.
Also consider if you have any private (i.e. customer) data on that server that might get you in trouble if a third party has/had access to it. You can (re)install servers in seconds, but data is out there forever once leaked.
PS: Did they obtain any SSH keys, or did you have password authentication enabled in the SSH configuration? (Don't do that!)
In addition to the wonderful technical advice already here for how to deal with the server, there is the question for how to deal with the anonymous person. If the proof contained the method of exploit I suggest something along the lines of: "Thank you for bringing this problem to our attention! We are taking steps to resolve the problem now, but would like to reward you for your work. If you let us know how you woul…
In addition to the wonderful technical advice already here for how to deal with the server, there is the question for how to deal with the anonymous person. If the proof contained the method of exploit I suggest something along the lines of: "Thank you for bringing this problem to our attention! We are taking steps to resolve the problem now, but would like to reward you for your work. If you let us know how you woul…
In addition to the wonderful technical advice already here for how to deal with the server, there is the question for how to deal with the anonymous person. If the proof contained the method of exploit I suggest something along the lines of: "Thank you for bringing this problem to our attention! We are taking steps to resolve the problem now, but would like to reward you for your work. If you let us know how you woul…
If this comes to ransom, rather than unethical/unexperienced gray hat thing, are there any good steps to take? Or hiring an expert consultancy is probably the only good option here?
Earlier quoted context omitted.
Hi, If you need security professional I can help you. Is the box on AWS, if so that would be a perfect use case for us? You won't have to worry to much about costs since we're starting up we're willing to work with your budget if you provide a testimonial for our website. Send me an email: contact@cloudhawk.io and we'll get started quickly.
I noticed IR services are not listed on your website. I hate to be this guy, but you don't want to offer IR/forensic services if you don't have experience doing exactly that. Your client can sue you if you get it wrong. ( http://arstechnica.com/security/2016/01/security-firm-sued-f... )
Why is this post flagged, and why is the usual "vouch" option missing?
- Check your /var/log/messages & audit.log & ssh/d.log
- Check lastb & last command outputs
- Take dump of network connections. (netstat)
- find out his 'tty' and spy on him! with something like sysdig or using strace (http://serverfault.com/a/423666)
Most importantly do these after turning off bash_history.So that attacker won't see you are gather information.
I assume you are running Linux server.
Earlier quoted context omitted.
It's the same concept as auditors, there's the big 4 that you've probably heard of, and a ton of other, smaller firms with varying quality. You could go with a known firm like iSec Partners, Matasano (now NCC) or Mitnick Security. They won't be cheap - at worst they may be able to refer you to some other reputable firm if your budget is limited.
> or Mitnick Security Please no. Not Mitnick. I'd rather funnel clients towards my competitors than Kevin Mitnick. He's a skilled social engineer, and his greatest social engineering success was manipulating the media into believing he speaks for hackers in general. He is not a programmer, his opinions on cryptography aren't insighful, etc. His only skill is deception.