Worst case scenario: You have a funny feeling you've been hacked, but you're not quite sure what to do next. If you're like most IT people, you don't necessarily know where to look for evidence that shows the system has indeed been compromised. Let's look at a few of the more common pieces of evidence that you may find after a system breach.
Suspicious-looking user accounts should be disabled and researched to determine who set up the account and why. Audit logs will show who created the account, if proper auditing is turned on. If you can find the date and time the account was created and the account turns out to be the result of a hack, you'll have a timeframe in which to look for other audit log events that may correspond.
To find out if a rogue application is listening for incoming connections, which could be used as a backdoor port for the hacker, use tools such as TCPView from Sysinternals or Fpipe from Foundstone. These Windows utilities show what applications are using any open ports on your system. For Unix systems, use netstat or lsof, which are built into the operating system. Since it is possible for a clever hacker to replace your netstat and lsof programs with Trojan versions [that don't show the ports opened by the hackers] it's best to scan the compromised system from another computer, using the infamous, free nmap port scanner from insecure.org. This will give you two different views of the system's open ports.
A hacker who compromises a Windows server may add or replace the programs launched via the registry from the following areas:
- HKLM > Software > Microsoft > Windows > CurrentVersion> Run
- HKCU > Software > Microsoft > Windows > CurrentVersion> Run
Malicious software also may be launched from the operating system's job scheduler. To see what jobs are scheduled to run on a Windows system, go to a command prompt and type AT. On a Unix system, use the cron or crontab commands to see the list of jobs scheduled to run.
Hackers who have compromised a Unix system may have used a root kit, which helps the hacker obtain root access by exploiting a vulnerability in the operating system or installed applications. Since numerous root kits are available to hackers, it can be very difficult to determine which files have been modified. There are programs to assist with this task, such as chrootkit.
There are so many possible ways for a hacker to cover his tracks, but looking for the items above is a good start on your journey toward determining whether or not your system has been compromised.
About the author
Vernon Haberstetzer, president of security seminar and consulting company i.e.security, has seven years of in-the-trenches security experience in healthcare and retail environments.
