[CentOS] How to tell if I've been hacked?
Christopher Chan
christopher.chan at bradbury.edu.hk
Wed Aug 19 03:58:08 UTC 2009
Ryan Pugatch wrote:
> Christopher Chan wrote:
>
>> Scott Ehrlich wrote:
>>
>>> There is a lot of talk about the vulnerable Linux kernel. I'm simply
>>> wondering the telltale signs if a given system has been hacked?
>>> What, specifically, does a person look for?
>>>
>>>
>> rpm -Va is a good start for modified binaries/libraries.
>> rootkit detectors is another thing you can try.
>>
>>
>> Other than that, it is checking your logs and looking for odd files
>> lying around...
>>
>>
>
>
> Also, processes running that you don't recognize. Users you don't
> recognize. Logged in sessions that you don't recognize. Free space
> shrinking abnormally. An increase in bandwidth usage that is unexpected.
>
Yeah...one should not assume that those will be hidden by rogue
libraries/binaries. Not every case will be taken that far or unspotted
before it gets that far.
More information about the CentOS
mailing list