Fishing for Hackers: Analysis of a Linux Server Attack

#1

Post by gighi » Tue, May 06, 2014, 4:28 PM UTC

Fishing for Hackers: Analysis of a Linux Server Attack
draios.com

Re: Fishing for Hackers: Analysis of a Linux Server Attack

#2

Post by salibhai » Tue, May 06, 2014, 4:54 PM UTC

Genius idea. Love it. Shared it with my favourite web host. I hope more security companies think like you do and do this type of reverse-phishing on the bad guys ;)

Re: Fishing for Hackers: Analysis of a Linux Server Attack

#3

Post by dthakur » Tue, May 06, 2014, 5:03 PM UTC

Great article. I had not heard of sysdig previously.

Based on the timestamps of the entered commands, I guess one of the takeaways for the attacker is to look into config management tools (eg ansible) :)

Re: Fishing for Hackers: Analysis of a Linux Server Attack

#4

Post by iplaman » Tue, May 06, 2014, 5:18 PM UTC

good job!! nicely done!

Re: Fishing for Hackers: Analysis of a Linux Server Attack

#5

Post by Dorian-Marie » Tue, May 06, 2014, 5:27 PM UTC

For those who don't know sysdig: http://www.sysdig.org/

Re: Fishing for Hackers: Analysis of a Linux Server Attack

#6

Post by pmh » Tue, May 06, 2014, 5:58 PM UTC

dthakur wrote: post #3

Great article. I had not heard of sysdig previously. Based on the timestamps of the entered commands, I guess one of the takeaways for the attacker is to look into config management tools (eg ansible) :)

Since you hadn't heard of sysdig before, you might also be interested in this article posted[1] a couple of weeks ago: http://bencane.com/2014/04/18/using-sysdig-to-troubleshoot-l...

[1]https://news.ycombinator.com/item?id=7622121

Re: Fishing for Hackers: Analysis of a Linux Server Attack

#7

Post by delluminatus » Tue, May 06, 2014, 6:02 PM UTC

salibhai wrote: post #2

Genius idea. Love it. Shared it with my favourite web host. I hope more security companies think like you do and do this type of reverse-phishing on the bad guys ;)

Most security companies do this; the term for a monitored, weakly-secured server like this is a "honeypot". It's a great way to find out about exploits in the wild, which is really valuable knowledge for every hat.

Having said that, it's amazing what OP could do with just one monitoring tool. Very impressive.

Re: Fishing for Hackers: Analysis of a Linux Server Attack

#8

Post by fragmede » Tue, May 06, 2014, 6:07 PM UTC

So a DO/Rackspace/AWS VPS with a guessable root password can expect to be cracked in ~4 hours?

That's terrible!

AFAIK, AWS defaults to ssh-key logins with password logins disabled. Can someone comment about Rackspace/DO?

Re: Fishing for Hackers: Analysis of a Linux Server Attack

#9

Post by Gepser » Tue, May 06, 2014, 6:09 PM UTC

¿But how did they enter? ¿Force attack?

Re: Fishing for Hackers: Analysis of a Linux Server Attack

#10

Post by johnnymonster » Tue, May 06, 2014, 6:10 PM UTC

Love this kinda stuff! Glad that there are people out there actively looking for the latest and greatest threats to the internet.