next up previous
Next: Logs Up: Oxford University Computing Society Previous: Windows

So how do I know if my computer gets cracked/what do I do

Since this talk was aimed at people inside Oxford University it mentions OUCS and OxCert. These organisations and email addresses should be replaced with those of your local computing service, or ISP, or their security team.

Detecting if your machine has been crack isn't always easy. In many cases OUCS will notice, because the cracker may use your machine to attack others and they watch network traffic for patterns (such as your computer running nmap on lots of remote hosts).

Another way is to periodically check that files haven't been altered. Normally a cracker will alter things to hide their cracking attempt and also to install 'back-doors' so that they can easily login to your computer in future. Sometimes these backdoors are as simple as an entry in /etc/inetd.conf that runs bash when you telnet in (to port 119 in the case I'm thinking of) and sometimes they are much more subtle and consist of 'trojaned' versions of services you are already running.

If you want an automated tool for doing this you may want to look at Tripwire: http://www.tripwiresecurity.com/, or http://www.tripwire.org/ for a Linux Open Source version. Tripwire is available for many Unixes, as well as Linux and Windows NT, although it is a commercial product.

You may want to write your own scripts that do a similar type of thing, in which case it's worth knowing about MD5sum. An MD5sum is a 128 bit digest function that is created from the source file. If you store both the MD5sum and also the length of each file you are interested in then you can be almost sure that you can detect when that file has changed.

Another alternative (and probably something you should do anyway) is to read the logs produced by your system and stored (under UNIX) in /var/log. By reading them reguarly you'll get to know what to expect and hopeful notice changes that indicate a cracking attempt. Many System Adminstrators write their own scripts that filter logs to make it easier for them to spot things that are out of the ordinary.

If you need help on security relate issues then please talk to OxCert (oxcert@ox.ac.uk) who are Oxford's Computer Emergency Response Team. They know what they are talking about!

If your computer has been cracked or you suspect it has been cracked you ought to talk to OxCert who will recommend how you proceed. Under nearly all circumstances you sohuld completely reinstall the operating system and all software because you do not know what files the cracker may have altered.



Subsections
next up previous
Next: Logs Up: Oxford University Computing Society Previous: Windows
Stephen White
2001-01-16