2 - Raspberry PI Community Projects

(...)
** 2004-11-29-19:50:49: DCC Send Accepted from ReV|DivXNeW|502: In.Ostaggio-
➥ iTa.Oper_-DvdScr.avi (713034KB)
(...)
** 2004-11-29-20:10:11: DCC Send Accepted from GAB: La_tela_dell_assassino.
➥ avi (666615KB)
(...)
** 2004-11-29-21:10:36: DCC Upload: Transfer Completed (666615 KB, 1 hr 24
➥ sec, 183.9 KB/sec)
(...)
** 2004-11-29-22:18:57: DCC Upload: Transfer Completed (713034 KB, 2 hr 28
➥ min 7 sec, 80.2 KB/sec)
These traces show that two video files have been stored on the server by way of the 82.50.72.202
IP address.
In parallel, the attacker also downloaded a pair of extra files, /tmp/pt and /tmp/loginx. Running
these files through strings leads to strings such as Shellcode placed at 0x%08lx and Now wait
for suid shell.... These look like programs exploiting local vulnerabilities to obtain administrative
privileges. Did they reach their target? In this case, probably not, since no files seem to have
been modified after the initial breach.
In this example, the whole intrusion has been reconstructed, and it can be deduced that the
attacker has been able to take advantage of the compromised system for about three days; but
the most important element in the analysis is that the vulnerability has been identified, and the
administrator can be sure that the new installation really does fix the vulnerability.
Chapter 14 — Security
409