LinuxGazette.net: Intrusion Detection with Tripwire

"A little over two years ago I was hacked. Someone broke into a web server I was administrating that had only Apache and OpenSSH running publically, and all packages were up-to-date. The hacker replaced my ps binary with his own to hide his processes, added a new service that was executed from the binary '/bin/crond ' (the space is intentional--it makes it look like a normal and an expected process in a running-processes listing and a normal binary in a directory listing). The 'crond ' process gathered usernames and passwords and stored them in a text file in the directory '/dev/pf0     /   /', (5 and 2 spaces respectively), which also contained a root shell. The chances of me finding and identifying this intrusion would have been extremely remote if I had not been running Tripwire.

"Tripwire is a file integrity checker for UNIX/Linux based operating systems and works as an excellent intrusion detection system. It will not prevent an intrusion; for this see my previous articles on setting up firewalls and securing a Linux distribution for help..."

Complete Story

Related Stories:

• eBCVG: Automated Penetration Testing--False Sense of Security(Aug 10, 2004)
• LinuxGazette.net: Securing a New Linux Installation(Aug 10, 2004)
• Linux Magazine: Finding Rootkits, Infections, and Files(Jul 11, 2004)
• HelpNetSecurity: Centralizing the Management of Network Security(May 18, 2004)