How to discover if your linux box is hacked!

[thewayne]

Interesting little piece. Guy has a linux box that is behaving badly. His friend, apparently more *nix knowledgeable than he, has an admin account on said box and starts poking around. Quickly he uncovers that the box has been compromised.

Here's the story: http://blog.gnist.org/article.php?story=HollidayCracking
Here's Schneier's take on it: http://www.schneier.com/blog/archives/2007/08/how_a_linux_ser.html

I'm sure there'll probably be a Slashdot story up soon. (not there right now, they're sometimes slow about posting stuff, or they have a big backlog or something)

Comments

[thewayne.livejournal.com]

A lot is using reasonable defenses, doing a good job of keeping up with patches, and don't do high-risk things on line. And when computing, always wear a condom!

[silveradept]

Hehe. Prophylactics for your computer. I suspect someone can or already has made a mint off of selling a suite of security-type products called the Computer Condom. (Assuming, of course, they could get the name past the correct authorities.)

While I'm a semi-experienced user in the sense that I have a vague idea of what "reasonable defences" might entail, like anti-virus software, a firewall (stack 'em if you can), keeping passwords secure, patching software, and the like, I wonder if there's something that I'm not doing that could help, and that I just don't know about. I suspect, though, I'd probably need to be a sysadmin if I really wanted to have a thorough knowledge of what goes on and how best to guard against intrusion while maintaining a reasonable experience using the computer. It may be a low-grade paranoia, in fact, born from using Microsoft OS.