Stories like this is what makes me believe immutable infrastructure is the future.
curious to know how you can make a linux distro immutable from any modification.
Hacked. A Short Story
11–20 of 50 posts
Re: Hacked. A Short Story
#12Re: Hacked. A Short Story
#13Stories like this is what makes me believe immutable infrastructure is the future.
curious to know how you can make a linux distro immutable from any modification.
By regularly redeploying or re-imaging. Exploits can only live for a certain timescale + you can lock down nearly every entry point (no need for SSH access for instance).
Re: Hacked. A Short Story
#14Offtopic: blog headers are becoming larger by the year it seems. Have there been any studies to see what such large headers do to readership?
Re: Hacked. A Short Story
#15Re: Hacked. A Short Story
#16What's really important is that you never should keep a compromised system like this running, even if you think you found all modifications the attacker did. You probably didn't. So save your configs and set this machine up from scratch.
Until you restore from backup: then you probably have a compromised system again.
If you restore data from backup you're fine. Configuration should be re-applied. Unfortunately you need to check every file with an executable bit that comes out of your backups - review shell scripts, recompile executables.
It's rare that attackers tamper with data, usually they just leak it. Source code may be targeted though.
Re: Hacked. A Short Story
#17What's really important is that you never should keep a compromised system like this running, even if you think you found all modifications the attacker did. You probably didn't. So save your configs and set this machine up from scratch.
I was gonna say much the same thing. Once a machine has been compromised, you've got to format and re-image it. The machine in the article could well still have a rootkit installed. Not to mention he doesn't seem to know the initial attack vector, so any security updates are meaningless if someones credentials have been stolen. Finally, if you're really paranoid, you also have to flash the bios in the machine too as…
I'd add that you don't even need to have the machine actually be compromised.
If you think it might be compromised, if you have reason to believe that perhaps something bad happened, you probably should re-image it. There may be smoke without a fire, but it's not worth the risk, is it?
Re: Hacked. A Short Story
#18He did not ask for money? Why on Earth? Dear fellow developers, know your importance and always ask for the work you have done.
He didn't configure exim4, for which he was hired. He wasn't hired to investigate the compromise, which he did do.
Re: Hacked. A Short Story
#19Offtopic: blog headers are becoming larger by the year it seems. Have there been any studies to see what such large headers do to readership?
Ironically new standard wider monitor screen ratios make you see nothing before scrolling, I guess we need to "above the fold" concept for web dev.