| 1 |
Grant, |
| 2 |
|
| 3 |
Maybe going forward (if you're not doing so already), one tool I've found to |
| 4 |
be useful in the past was AIDE. While it certainly won't prevent a break-in, |
| 5 |
it can certainly be useful when trying to find out what changed on your |
| 6 |
system. |
| 7 |
|
| 8 |
Later, |
| 9 |
|
| 10 |
Shawn |
| 11 |
|
| 12 |
On 2/12/07, Paul Sebastian Ziegler <psz@××××××××.de> wrote: |
| 13 |
> |
| 14 |
> Hi Grant, |
| 15 |
> |
| 16 |
> personally (but this is by far only ONE possible setup for your task) |
| 17 |
> I'd advise you to connect eth0 to wan through a box set up as a bridge |
| 18 |
> (try brctl). If that box has a good wireless card and good drivers (this |
| 19 |
> mostly means "if that box isn't running Windows") you can also put that |
| 20 |
> wireless-card into promiscuous mode lock it to your chanel and ssid and |
| 21 |
> feed wireshark your WEP-Key or WPA-PSK for decryption. |
| 22 |
> If not, then you'll have to use a second box for the wireless sniffing. |
| 23 |
> |
| 24 |
> BTW. current rootkits won't just replace ps or some other tools. Good |
| 25 |
> rootkits do not run in userspace; they run in kernelspace. They directly |
| 26 |
> intercept the function-calls. Just another thing to keep in mind while |
| 27 |
> trying to scan for them. |
| 28 |
> |
| 29 |
> hth |
| 30 |
> Paul |
| 31 |
> |
| 32 |
> Grant schrieb: |
| 33 |
> >> > A good rootkit will install a "ps" that won't show the 'bot |
| 34 |
> >> > processes. The one time a machine of mine got hacked, netstat |
| 35 |
> >> > still worked, but I don't know why a hacked netstat couldn't be |
| 36 |
> >> > installed as well. |
| 37 |
> >> |
| 38 |
> >> > Looking through /proc/≤pid> is probably still reliable. |
| 39 |
> >> |
| 40 |
> >> |
| 41 |
> >> Hello Grant, |
| 42 |
> >> |
| 43 |
> >> I keep an old portable around, running wireshark and a flat hub. |
| 44 |
> >> You can set your ethernet address to 0.0.0.0 and fire up wireshark. |
| 45 |
> >> |
| 46 |
> >> You can then sniff any (ethernet) segment of your network for |
| 47 |
> >> nefarious traffic or male-configured network applictions. |
| 48 |
> > |
| 49 |
> > Ok, it sounds like the key to figuring this out is watching the |
| 50 |
> > outgoing network traffic for weird stuff. eth0 is on the WAN and |
| 51 |
> > wireless ath0 is on the local subnet. How would you monitor the |
| 52 |
> > outgoing traffic considering my setup? |
| 53 |
> > |
| 54 |
> > - Grant |
| 55 |
> > │ИМ╒▀╛z╦ ·з(╒╦&j)b· bst== |
| 56 |
> |
| 57 |
> -- |
| 58 |
> gentoo-user@g.o mailing list |
| 59 |
> |
| 60 |
> |
| 61 |
|
| 62 |
|
| 63 |
-- |
| 64 |
"Doing linear scans over an associative array is like trying to club someone |
| 65 |
to death with a loaded Uzi." |
| 66 |
Larry Wall |
Archives