Hacker Tracking â A Case Study - Tracking Hackers

Recommendations

Info

Case Study Red Hat 6.2 System (the lower bar) Hacked in less than 24 hours Automated attack Common tools installed on the server Common Sequence of events
¡ ¡ ¡ ¡ Sequence of Events Hacker gathers information about the system by scanning and logging into the ftp server Exploits RPC daemon Installs a “root kit” (t0rn variant) Trojan ps,ls and netstat Sniffier (linsniff) ¡ DdoS tools SSH back door IRC 'bot' (emech)
Page 1 and 2: Hacker Tracking - A Case Study Gide
Page 3 and 4: What is a Research Honeypot? A syst
Page 5 and 6: The Servers Default but patched ins
Page 7 and 8: Network Traffic Monitoring SNORT Si
Page 12 and 13: The log begins from: Nov 9 19:44:42
Page 14 and 15: lpd 6295 root cwd DIR 3,1 4096 8897
Page 16 and 17: lpd 6372 root 424u IPv4 26262 TCP *
Page 18: added:/usr/bin/kidz/emech-2.8.1/con
Page 22 and 23: #!/bin/sh clear echo "Educational p
Page 24 and 25: #!/bin/sh echo "+------------------
Page 26 and 27: ¡ Let's Find Him Things we know ab
Page 28 and 29: Modified 'install' script From: cat
Page 30 and 31: Following the Hacker
Page 32 and 33: Zombie Attacks Victim
Page 34 and 35: Victim Sends Email Notification to
Page 36 and 37: Attacker's Browser Contacts our Ser
Page 38 and 39: Embedded HTTP cgi calls Date: Wed,
Page 40 and 41: Next Steps Create legal consensus o
Page 42: Thank You Gideon J. Lenkey, CISSP 1

Hacker Tracking â A Case Study - Tracking Hackers

Create successful ePaper yourself

Delete template?

Save as template?

Hacker Tracking â A Case Study - Tracking Hackers