In Depth

Intrusion Detection: Ain't No Flyswatter Big Enough

What do you do when somebody breaks into one of your organization's servers? When waving your hands wildly doesn't help, you'll need an intrusion detection plan.

By Simson Garfinkel

In one version of this attack, the attacker makes a copy of each program that he or she wants to modify. The operating system is then modified so that when the computer tries to read the contents of a program, it reads from the original. But when it tries to execute a program, it executes the version that's been modified. In another variant of this attack, the bad guy modifies the Tripwire program itself so that the program stops looking at the files that have been compromised.

Both of these attacks can be easily subverted by booting the affected computer from a CD-ROM. If you run with an operating system that's known to be good and a fresh copy of Tripwire, you can rapidly determine where the modifications have been made.

Of course, another alternative is to simply evacuate the data that you care about, blast off and nuke from orbit.

Other stories by Simson Garfinkel

• Email
• Print
• Comments
• Digg This
• SlashDot