Hacker News Reader

Comment by HillRat | Hacker News Reader

Many years ago, that's how I found a vendor-managed (but not vendor-patched) system had been compromised; I went from "why the hell is that multi-pipe command segfaulting?"to "why the hell aren't the system binaries stripped?" to "how long has this thing been compromised?"

View on HN

My favorite incident was back when ISP's gave you Unix shell accounts to get Internet access. I logged into mine, searched back through command history to find the name of an ftp site I had previously connected to, and saw a bunch of "ps -fe" commands. Now I always type in "ps -ef". So I new my account was compromised. (Boring compromise really -- someone sniffed my password, and used my shell account to run an Eggdrop IRC bot).

What is binary stripping?

https://en.wikipedia.org/wiki/Strip_(Unix)

Compiled programs sometimes contain the names of the functions.

To reduce binary size and/or discourage reverse engineering, the names can be stripped out.

Not just names of functions; also names of variables and potentially a great many other things.

Stripping binaries generally refers to removing debugging information of all sorts.

Exactly. In this case -- working from antique memory here -- Solaris binaries were normally stripped, while the compromised versions placed by the hacker weren't, which was an immediate red flag. The system was compromised as part of a very large-scale, probably North Korean, attack that exploited an OpenWindows buffer overflow bug that was fixed many patch-revs ago by the time I saw the system (and shouldn't have been exploitable over the Internet anyway, but the firewall was also not properly set up at the time of compromise). Drive-by hacking, in other words. Luckily their compromised binaries -- specifically a 'ps' that filtered out the hackers' background attack processes -- weren't particularly robust to arbitrary input.

Reply on news.ycombinator.com