Comp got owned. Need advice.
Resently I totaly got owned. I left my computer on while I was sleeping and awoke to my firewall crashed, a proxy service running on my comp and a backdoor trojan. Also another prog was running which was spamming tons of people with windows messages. Along with my permissions on my power user account was tottaly f'ed up.
Well anyways, I disabled everything and tried to clean up and fix everything I could. I also checked my logs and I tracked it down to one ip. Im still debating on what I should do. Im guessing this person is going through a proxy or proxy's so its proly some other poor suckers ip. Any advise on what I should do. I was kinda thinkin about going after the ip I have and maybe go down the line ;-p.
Im done for now with windows lol. Back to Linux. Im deciding what linux distib I should install. Im wanting something thats more security oriented. I know they all are, how about instead just say what your favorite non windows os is and why you like it ;-p
Re: Comp got owned. Need advice.
Well Smiles, I hate to be the one to do it, but I think it needs to be done... so I am gonna lay into you a little.
Quote:
Resently I totaly got owned. I left my computer on while I was sleeping and awoke to my firewall crashed, a proxy service running on my comp and a backdoor trojan. Also another prog was running which was spamming tons of people with windows messages. Along with my permissions on my power user account was tottaly f'ed up.
What did you learn from all of this? Well I have a few questions for you...
Why does your system remain online if the firewall is down? This is an awful design for obvious reasons.
Why do you allow remote installtion of software?
Why do you allow remote maniptulation of the security policy?
Why do you allow remote activation of services?
Quote:
Well anyways, I disabled everything and tried to clean up and fix everything I could. I also checked my logs and I tracked it down to one ip. Im still debating on what I should do. Im guessing this person is going through a proxy or proxy's so its proly some other poor suckers ip. Any advise on what I should do. I was kinda thinkin about going after the ip I have and maybe go down the line ;-p.
http://www.cert.org/tech_tips/win-UN...ompromise.html
I think it is likely the "attacker" did not originate from the logged IP (and it seems odd they would let these logs survive when they had such complete control of such a poorly configured system.) and I think we both know that the likelihood of you tracking anyone down is slim to none.
Moving right along...
Quote:
Im done for now with windows lol. Back to Linux. Im deciding what linux distib I should install. Im wanting something thats more security oriented. I know they all are, how about instead just say what your favorite non windows os is and why you like it ;-p
This is the part that bugged me... "wah! I can't use this system so I am just going to switch to something else because I once heard it was better. Perhaps this would be a good time to learn how to administer a system to be secure (the NT line has significant centralized documentation and auditing tools for this exact topic) rather than just jumping from one system to the next and blaming the system for the problems.
You say you want something that is more security oriented, yet you wish to switch to a system that uses a monolithic kernel, less finely grained access controls, no segregation of administrators and operators, no trusted paths, no secure logon sequence, no secure subsystems, a lack of integrated file system key management, single command/multi actioned security policy (impossible to predict rights propigations), and the lack of a trusted facilities manual (which is really what you need most it would seem).
My favorite non-windows OS? Normally I'd say AITOS, but that is still in development and not overly useful for anything other than an integrated ERP guard OS just yet... so I'd have to say that KSOS running a collection of various project software from a NeXTStep inspired GUI to multi level secure aware NFS, HTTP, FTP, and SMTP servers all on PDP 11/70 emulation on a 21364 system. Why? Because I like running an OS designed by Ford and I like having a system that is theoretically secure from remote attacks (ah the beauty of finite state machines) makes for good bragging rights... ;)
catch
