How to start?
- restart the system
- kill the processes
- delete malicious files
MAKE SURE THE SYSTEM WAS HACKED:
- check system logs
- check commands history
- check login history
- check monitoring graphs for any abnormalities
- check running processes: top, ps, netstat, lsof
- If you connect to the system remotely, e.g. ssh, avoid using credentials that can be reused on other systems and consider them lost: change them as soon a possible
- Don’t store data on the harddrive:
- Set HISTFILE to /dev/null
- Store temporary files in a filesystem backed by a tmpfs (in RAM), remotely or on a USB drive.
OK, SYSTEM WAS COMPROMISED. HOW TO CONTINUE?
Isolate the system
- unplug the network cable or apply the necessary firewall rules
- if it is a virtual machine, create a snapshot
- How did the intruder get it?
- When did that happen?
- What kind of activity was performed on the server? (what was changed, installed, what kind of processes are running)
- Inform CSIRT about your discoveries.
Acquire live data
- collect network data
- collect user logins
- check running processes
- check open files
- check mounted devices
- check loaded kernel modules
- check the abnormalities in the collected data
- dump a core of the processes (use gcore or gdb)
- collect filesystem metadata
- save all open files
- copy files from the proc folder