I accidentally left an open port on my router, leaving access to one of my computers via SSH, using a rather insecure password. I noticed because I checked /var/log/auth.log and there is just one entry from the outside. There's no bash history nor anything easily noticeable. What should I check to know my computer is not compromised?
1 Answer
Check thoroughly, if you want, but clever attackers may leave easy-to-spot signs but hide other cleverly hidden backdoors... It could be impossible to be sure...
The problem is, once compromised, the machine (and other machines it can access to) becomes unreliable (as it is impossible to know if they changed anything. So you have to assume that they did. And if they did, they could alter the OS/kernel, the commands, the filesystem, the boot sectors, anything. It could just act "normal" and hide specific files or folders or network packets. You can't trust any commands on a machine that got accessed by hackers.)
Usually the best tactic (and the fastest!) is the "nuke from orbit" approach : unplug that machine from all networks (lan, etc), backup docs, and reinstall the whole machine using a CD (ie, a clean and not tempered with source). And then restore only the docs on it (no exe, no dll, no binaries, no scripts (or check them thourougly), etc). And fix what allowed the breach in the first place before plugging it in the net again.
The problem is that, in addition to that machine, once having access to the lan they could have used tools to get access to any of the other machines as well (including the router).
The same tactic would apply on those too...
Leave the "investigation" part to other persons and other times (keep the disk around for when you have time).
For a mode detailled procedure, https://serverfault.com/a/218011/146493 , by RobM, is a good read, with sane and important steps.
answered Jan 15, 2013 at 10:16
statimportant files in your server.don't forget to read this and this