Hacked. A Short Story • Hacker News Board

Re: Hacked. A Short Story

#21

Post by nodata » Mon, Jan 19, 2015, 1:12 PM UTC

pjc50 wrote: post #16

nodata wrote: post #10

Earlier quoted context omitted.

Until you restore from backup: then you probably have a compromised system again.

If you restore data from backup you're fine. Configuration should be re-applied. Unfortunately you need to check every file with an executable bit that comes out of your backups - review shell scripts, recompile executables. It's rare that attackers tamper with data, usually they just leak it. Source code may be targeted though.

the risk is lower with data files, but it's not gone.

buffer overflows in non-executable files means it's easy for someone who wants to, to recompromise a machine: pdf, gif, jpg, whatever.

Re: Hacked. A Short Story

#22

Post by jwildeboer » Mon, Jan 19, 2015, 1:21 PM UTC

AFAICS the system wasn't updated for a year? Well, that's just plain stupid.

Re: Hacked. A Short Story

#23

Post by song » Mon, Jan 19, 2015, 1:22 PM UTC

Luyt wrote: post #18

ludwigvan wrote: post #8

He did not ask for money? Why on Earth? Dear fellow developers, know your importance and always ask for the work you have done.

He didn't configure exim4, for which he was hired. He wasn't hired to investigate the compromise, which he did do.

Still, he provided a service that was important for the customer. And, the customer wanted him to configure exim4 because a lot of the emails sent were marked as spam. The compromise was most likely the biggest reason for that.

Re: Hacked. A Short Story

#24

Post by song » Mon, Jan 19, 2015, 1:24 PM UTC

olalonde wrote: post #2

Stories like this is what makes me believe immutable infrastructure is the future.

And that's why I'm quite excited by the concept of Coreos and the way they do updates.

Re: Hacked. A Short Story

#25

Post by tikl1 » Mon, Jan 19, 2015, 1:24 PM UTC

ludwigvan wrote: post #8

He did not ask for money? Why on Earth? Dear fellow developers, know your importance and always ask for the work you have done.

It's complicated to just do something you were not supposed to and then go with: "look I know I had to do that but instead I did that so please give me [amount you never aggreed to pay]".

What he could have done on the other hand is: inform the client of the attack and propose him to get rid of it for a certain fee...

Re: Hacked. A Short Story

#26

Post by anon4 » Mon, Jan 19, 2015, 1:32 PM UTC

CiaranMcNulty wrote: post #13

curiously wrote: post #11

Earlier quoted context omitted.

curious to know how you can make a linux distro immutable from any modification.

By regularly redeploying or re-imaging. Exploits can only live for a certain timescale + you can lock down nearly every entry point (no need for SSH access for instance).

How do you redeploy without some sort of remote access?

Re: Hacked. A Short Story

#27

Post by LukeB_UK » Mon, Jan 19, 2015, 1:34 PM UTC

fmavituna wrote: post #19

ronnier wrote: post #14

Offtopic: blog headers are becoming larger by the year it seems. Have there been any studies to see what such large headers do to readership?

Ironically new standard wider monitor screen ratios make you see nothing before scrolling, I guess we need to "above the fold" concept for web dev.

"There is no fold" by Luke Wroblewski: https://storify.com/xiwcx/there-is-no-fold-1

Re: Hacked. A Short Story

#28

Post by acveilleux » Mon, Jan 19, 2015, 2:25 PM UTC

song wrote: post #23

Luyt wrote: post #18

Earlier quoted context omitted.

He didn't configure exim4, for which he was hired. He wasn't hired to investigate the compromise, which he did do.

Still, he provided a service that was important for the customer. And, the customer wanted him to configure exim4 because a lot of the emails sent were marked as spam. The compromise was most likely the biggest reason for that.

Sometimes it's like that. He could try and get the customer to pay him for this but he might lose on the long term if they've been a recurring customer for a long time.

Re: Hacked. A Short Story

#29

Post by acveilleux » Mon, Jan 19, 2015, 2:27 PM UTC

anon4 wrote: post #26

CiaranMcNulty wrote: post #13

Earlier quoted context omitted.

By regularly redeploying or re-imaging. Exploits can only live for a certain timescale + you can lock down nearly every entry point (no need for SSH access for instance).

How do you redeploy without some sort of remote access?

You use cloud VM API and images that use something like chef or salt to configure themselves.

Basically, you destroy a VM and spin up a new one with one of your images, it will then use chef or salt to pull in its config.

SSH isn't needed then.

Re: Hacked. A Short Story

#30

Post by [deleted] » Mon, Jan 19, 2015, 2:29 PM UTC

derFunk wrote: post #4

What's really important is that you never should keep a compromised system like this running, even if you think you found all modifications the attacker did. You probably didn't. So save your configs and set this machine up from scratch.

[deleted]