Hacker News Reader

Comment by troydavis | Hacker News Reader

Of the 6-7 breaches I've heard the details of, they were detected because either:

- an engineer stumbled upon clear evidence of a rootkit, like a leftover dotfile or shell history entries

- the exfiltrated data got used and someone noticed

(Different story for active intrusions, where the intruder is detected when they first breach a system. At least anecdotally, the passive after-the-fact detection above seems more common, though.)

View on HN

For a really great book about an Active Intrusion this is a classic. https://www.amazon.com/Cuckoos-Egg-Tracking-Computer-Espiona...

Is this the one that started to realise what was happening due to unpaid time on a machine amounting to 25c or similar?

Yup. Cliff Stoll. His first book is a great read. The second as well, but he caught a lot of flack for his 'Luddite' views. Personally, and with the aid of hindsight, I think he just undershot on his predictions.

I think so. It's also the one in which the protagonist stalled the attacker by means of a keyring, which is not so much a thing you can do any more.

That's the one. I remember reading it in 1991 or 1992, and just having my mind blinded by the whole story.

I re-read Cuckoo's Egg recently, and it was still a riveting read! Especially when considering that it all happened over telnet.

Thanks for your reply.

I assume many startups use AWS or GCE (with auto scaling) and thus don't necessarily setup/SSH into each and every machine/VM. Wouldn't this make rootkit detection more difficult?

edit: how would an active intrusion detection take place?

You don't have to ssh in to a system in order to detect a rootkit or intrusion. You could run a rootkit detection app like rkhunter[1] or chrootkit[2] (though I don't know how good these programs are at doing what they claim to do) or run a filesystem integrity monitoring app or HIDS[3] like Samhain[4]. You might also pick up intrusions via a network intrusion detection system like Snort[5].

[1] - https://en.wikipedia.org/wiki/Rkhunter

[2] - https://en.wikipedia.org/wiki/Chkrootkit

[3] - https://en.wikipedia.org/wiki/Host-based_intrusion_detection...

[4] - https://en.wikipedia.org/wiki/Samhain_(software)

[5] - https://en.wikipedia.org/wiki/Snort_(software)

> don't know how good these programs are at doing what they claim to do

They're good for checking old backups to see if you were hacked in the 90s, not so useful for today.

The first two, sure. Snort, at least, remains under active maintenance, and while I'm not in network security myself any more, those I know who still are have had good things to say about it.

So what would you use today?

I don't think there is any useful software intended for the same purpose as those two. You'll need something like Samhain to spot the breach when it happens.

It will definitely require some configuration, but AIDE is an awesome tool. You take hashes of files when they are in a known good state (and are not supposed to change) and then monitor them for changes.

http://aide.sourceforge.net/

It takes a good amount of setup because there are a lot of files that routinely change that you will want to ignore.

Reply on news.ycombinator.com