241–246 of 246 posts
Earlier quoted context omitted.
> Disclaimer I own a data center I'm curious why you think owning a DC makes you less qualified to respond? Presumably because someone that senior is less in touch with day-to-day security operations?
The "disclaimer" prologue is often humble bragging. It's often less about flagging a conflict of interest and more about claiming to have authority or status.
Earlier quoted context omitted.
Contact me if you need a recommendation. I can point you to good security consultants probably within your budget.
Thanks, will have that in mind, as its' not up to me to allocate funds for consulting, etc. Any idea how much can such a service cost, assuming web application with a very common stack (such as Ruby on Rails + PostgreSQL)? Is it something like $5k, $10k, or $20k+? Or it really depends? Sorry if it's a very amateur question, I have no experience in dealing with such companies so have no clue how much can it cost.
Security is not cheap.
Disclaimer: worked for such company.
Earlier quoted context omitted.
just a note: intelligent exploiters hide their files inside of yours, so the -mtime is useless in many cases, they will set the mtime of their upload to match the rest of the folder they hide in. command history is also easy to alter if you know what you are doing.
yes, excellent point, agree. I run the scan regardless in case I'm dealing with the non-intelligent exploiter type ;)
In addition to the wonderful technical advice already here for how to deal with the server, there is the question for how to deal with the anonymous person. If the proof contained the method of exploit I suggest something along the lines of: "Thank you for bringing this problem to our attention! We are taking steps to resolve the problem now, but would like to reward you for your work. If you let us know how you woul…
My suggestions: If your server has confidential/money related info. take down the server. If not , wait because even if you bring up new server. How do you know , he won't crack it again? - Check your /var/log/messages & audit.log & ssh/d.log - Check lastb & last command outputs - Take dump of network connections. (netstat) - find out his 'tty' and spy on him! with something like sysdig or using strace ( http://serve…
> - Check lastb & last command outputs I wasn't aware of lastb, thanks. I'm impressed that my home server has logged over 650,000 failed logins since 1 July, and a couple of machines I administer in a university over 300,000 each. That's every three-four seconds for the home server. That's quite a lot of bandwidth, worldwide.