Linux - Open Source White Papers
An Experiment in Forensics Reveals Attackers' Techniques
Overview
Around midnight of November 7, 2000, a Linux server was broken into. In and of itself, this event was nothing special -- systems get hacked all the time. What made this attack different were the forensic dissections that followed.
The Linux system in question had been setup by the Honeynet Project, a coalition of security professionals interested in learning and in sharing what they learn about scanning and attacks. To this end, an ID (Intrusion Detection) system was set up to collect network traces of scans and attacks, and monthly challenges, along the lines of "identify the scanning tool" or "name that hack". When a Linux system was attacked and thoroughly subverted only two and a half days after it was installed, the system itself became The Forensic Challenge.
The official results of the challenge can be viewed at the Honeynet Project Web site (see Resources). In this article, I go through my own process of analysis of the attack, and what the attacked installed or otherwise modified the victim system, with the added insights of Dave Dittrich, the Senior Security Engineer at the University of Washington. What the attacker did after the initial exploit is even more interesting than the attack itself.
| Publisher | Spirit.com | File Format | HTML |
|---|---|---|---|
| Date Published | May 2001 | Downloads | 12 |
| Format | White Papers | ||
| Topics | |||
-
Did you find this white paper useful? 1 out of 2 users found this white paper useful
White Paper RSS
Download
Register
