لطفا منتظر باشید ...
Recipe 9.41 Recovering from a Hack
9.41.1 Problem
Your system has been hacked via the
network.
9.41.2 Solution
- Think. Don't panic.
- Disconnect the network cable.
- Analyze your running system. Document everything (and continue
documenting as you go). Use the techniques described in this chapter. - Make a full backup of the system, ideally by removing and saving the
affected hard drives. (You don't know if your backup
software has been compromised.) - Report the break-in to relevant computer security incident response
teams. [Recipe 9.42] - Starting with a blank hard drive, reinstall the operating system from
trusted media. - Apply all security patches from your vendor.
- Install all other needed programs from trusted sources.
- Restore user files from a backup taken before the break-in occurred.
- Do a post-mortem analysis on the original copy of your compromised
system. The Coroner's Toolkit (TCT) can help
determine what happened and sometimes recover deleted files. - Reconnect to the network only after you've diagnosed
the break-in and closed the relevant security hole(s).
9.41.3 Discussion
Once your system has been compromised, trust nothing on the system.
Anything may have been modified, including applications, shared
runtime libraries, and the kernel. Even innocuous utilities like
/bin/ls may have been changed to prevent the
attacker's tracks from being viewed. Your only hope
is a complete reinstall from trusted media, meaning your original
operating system CD-ROMs or ISOs.The Coroner's Toolkit
(TCT) is a collection of scripts and programs for analyzing
compromised systems. It collects
forensic data and can sometimes recover (or at least help to
identify) pieces of deleted files from free space on filesystems. It
also displays access patterns of files, including deleted ones.
Become familiar with TCT before any break-in occurs, and have the
software compiled and ready on a CD-ROM in advance.The post-mortem analysis is the most time-consuming and open-ended
task after a break-in. To obtain usable results may require a lot of
time and effort.
9.41.4 See Also
CERT's advice on recovery is at http://www.cert.org/tech_tips/win-UNIX-system_compromisel.
The Coroner's Toolkit is available from http://www.porcupine.org/forensics/tctl
or http://www.fish.com/tct.
