Clean up all the things - Revision history

Lilith2: /* Email streams */

2015-09-13T10:12:23Z

‎Email streams

Lilith2: /* I think my machine is infected with the coodies. Now what? */

2015-09-13T10:10:55Z

‎I think my machine is infected with the coodies. Now what?

Alex at 08:34, 11 September 2015

2015-09-11T08:34:27Z

Lilith2: /* News & watchdogs */

2015-08-29T08:37:06Z

‎News & watchdogs

Lilith2: /* News & watchdogs */

2015-08-28T20:45:46Z

‎News & watchdogs

Lilith2: /* pdftk and sed */

2015-08-16T14:42:05Z

‎pdftk and sed

Lilith2 at 14:21, 16 August 2015

2015-08-16T14:21:00Z

Lilith2: /* Resources */

2015-08-12T20:34:06Z

‎Resources

Lilith2 at 19:42, 10 August 2015

2015-08-10T19:42:02Z

Lilith2 at 09:17, 31 July 2015

2015-07-31T09:17:21Z

@@ Line 560: / Line 560: @@
 ==== Check crontab ====
 [[Kinky_linux_command-line#Running_jobs.2C_jobs.2C_jobs.21|Check crontab]], it may be that the keylogger is relaunched regularly in case it is shut off or if the system reboots.
-==== Email streams ====
+==== Check email streams ====
 [[Linux_security#Traffic_monitoring|Look at the email streams]]. When programs start sending email by using another IP than your email server, it might be something fishy. It can of course also be legitimate. Also consider that a keylogger might just log in to your email server with valid credentials and email from there.

@@ Line 544: / Line 544: @@
 === I think my machine is infected with the coodies. Now what? ===
-* Overcome any embarrassment. Getting coodies can happen to the best. Plus embarrassment doesn't work, it lacks the head, hands and keyboard.
+Overcome any embarrassment. Getting coodies can happen to the best. Plus embarrassment doesn't work, it lacks the head, hands and keyboard.
-* [[Kinky_linux_command-line#Looking_at_processes|Take a look at your processes]] (with ps -aux, htop or pstree), but if you are new to linux and your [[Installing_linux|install]] took care of running most of the programs it can be hard to know what’s really supposed to be running vs. what’s not supposed to be there. Plus some of the best rootkits hide from such checks. If you installed [[Linux_security#Installing_intrusion_detection|intrusion detection]] software, you may find clues in its reports.
-* Boot the machine from a known safe live-CD image and [[Linux_security#Install_rootkit_scanners|scan for suspicious files with rkhunter and chkrootkit]].
+==== Check for new accounts ====
-* [[Kinky_linux_command-line#Running_jobs.2C_jobs.2C_jobs.21|Check crontab]], it may be that the keylogger is relaunched regularly in case it is shut off or if the system reboots.
+Check <code>/etc/passwd</code> for new accounts. Especially new accounts you don't recognise with a UID less than 500 are very suspicious. If a new account with a UID of 0 is in the list, definitely check it out. Also look for orphaned files, indicators of an account that has been deleted (may take a while):
-* [[Linux_security#Traffic_monitoring|Look at the email streams]]. When programs start sending email by using another IP than your email server, it might be something fishy. It can of course also be legitimate. Also consider that a keylogger might just log in to your email server with valid credentials and email from there.
-* A trick to try if you suspect a keylogger is present:
+ $ sudo find / -nouser -print
 # Type a random unique string on your keyboard in the live running machine.
 # Reboot the machine from a known LiveCD and [[Kinky_linux_command-line#Searching_for_text_with_grep|grep for that string]].
 # Find out where the string is stored, and you may have the temp file of the keylogger.
 # Check the folder it is in, and check the folders upward in the tree.
+==== Hit the mailinglists and forums ====
 The above steps may minimally prepare you for receiving optimal help on forums and mailinglists or from us. You can find us on IRC.
-And if all else fails:
+==== If all else fails ====
-* If a VM was infected, simply revert back to an earlier snapshot or an earlier ova of it.
+* If a VM was infected, revert back to an earlier snapshot that you think was clean or import an earlier exported ova of it. This does not help if the host was reached, of course.
 * A non-VM machine can be reinstalled. To make this experience an enjoyable event if and when it happens, have [[Linux_security#Backups|regular backups of data]], and that personal information on an [[Linux_security#Using_removable_storage_media|external disk]] and still totally clean. We laugh in the face of coodies and their masters!
-It is possible for malware to persist across a re-format and re-install, if it is sufficiently ingenious and sophisticated: e.g., it can persist in the bios, in the firmware for peripherals (some hardware devices have firmware that can be updated, and thus could be updated with malicious firmware), or with a virus infecting data files on removable storage or on your backups. However, *most* malware doesn't do anything quite this nasty. Therefore, while there are no guarantees, re-formatting and re-installing should get rid of almost all malware you're likely to encounter in the wild. But, not all. Targeted surveillance and spy vs spy games is another game entirely?
+It is possible for malware to persist across a re-format and re-install, if it is sufficiently ingenious and sophisticated: e.g., it can persist in the BIOS, in the firmware for peripherals (some hardware devices have firmware that can be updated, and thus could be updated with malicious firmware), or with a virus infecting data files on removable storage or on your backups. However, *most* malware doesn't do anything quite this nasty. Therefore, while there are no guarantees, re-formatting and re-installing should get rid of almost all malware you're likely to encounter in the wild. But, not all. Targeted surveillance and spy vs spy games is another game entirely?
 This page continues in [[reverse engineering]], really more of a montessori type pet peeve hack project to dive deeper in this direction.

← Older revision		Revision as of 08:34, 11 September 2015
Line 589:		Line 589:
	== References ==		== References ==

−	[[Category:~~Resources~~]]	+	[[Category:How_To]]

@@ Line 570: / Line 570: @@
 * Anti-online http://www.antionline.com/
 *  How to Destroy a Laptop with Top Secrets - How did GCHQ do it to the Guardian's copy of Snowden's files? https://media.ccc.de/browse/conferences/camp2015/camp2015-6799-how_to_destroy_a_laptop_with_top_secrets.html
 === Finfisher ===

← Older revision		Revision as of 20:45, 28 August 2015
Line 570:		Line 570:

	* Anti-online http://www.antionline.com/		* Anti-online http://www.antionline.com/
		+	* How to Destroy a Laptop with Top Secrets - How did GCHQ do it to the Guardian's copy of Snowden's files? https://media.ccc.de/browse/conferences/camp2015/camp2015-6799-how_to_destroy_a_laptop_with_top_secrets.html

	=== Finfisher ===		=== Finfisher ===

@@ Line 201: / Line 201: @@
 The <code>\</code> are for breaking out of the single quoted string then escaping the single quote.
-<code>PdfID0</code> and <code>PdfID1</code> are file identifiers. They are an md5 of various info about the file so that it has a unique string to identify the doc without having to use the filename. If you want to scrub those too, use sed as above. There’s no geeky tricks needed for cleaning those two from the metadata with sed, it’s pretty straightforward.
+<code>PdfID0</code> and <code>PdfID1</code> are file identifiers. They are an md5 of various info about the file so that it has a unique string to identify the doc without having to use the filename. If you want to scrub those too, use sed as above. There’s no [[Kinky_linux_command-line#Regular_expressions|geeky tricks]] needed for cleaning those two from the metadata with sed, it’s pretty straightforward.
 ==== mat ====

@@ Line 561: / Line 561: @@
 * A non-VM machine can be reinstalled. To make this experience an enjoyable event if and when it happens, have [[Linux_security#Backups|regular backups of data]], and that personal information on an [[Linux_security#Using_removable_storage_media|external disk]] and still totally clean. We laugh in the face of coodies and their masters!
-This page continues in [[reverse engineering]], really more of a montessori type pet hack project to dive deeper in this direction.
+It is possible for malware to persist across a re-format and re-install, if it is sufficiently ingenious and sophisticated: e.g., it can persist in the bios, in the firmware for peripherals (some hardware devices have firmware that can be updated, and thus could be updated with malicious firmware), or with a virus infecting data files on removable storage or on your backups. However, *most* malware doesn't do anything quite this nasty. Therefore, while there are no guarantees, re-formatting and re-installing should get rid of almost all malware you're likely to encounter in the wild. But, not all. Targeted surveillance and spy vs spy games is another game entirely?
 == Resources ==

← Older revision		Revision as of 20:34, 12 August 2015
Line 568:		Line 568:

	* Anti-online http://www.antionline.com/		* Anti-online http://www.antionline.com/
		+
		+	=== Finfisher ===
		+
		+	* FinFisher Spyware C&C Server Detected in US http://securitywatch.pcmag.com/none/301324-finfisher-spyware-c-c-server-detected-in-us

	== Related ==		== Related ==

← Older revision		Revision as of 19:42, 10 August 2015
Line 580:		Line 580:

	== References ==		== References ==
		+
		+	[[Category:Resources]]

← Older revision		Revision as of 09:17, 31 July 2015
Line 338:		Line 338:

	# /etc/init.d/postfix restart		# /etc/init.d/postfix restart
		+
		+	== Clean up your language ==
		+	If you are blogging, mind authorship analysis. Have a bar of soap, or learn about [[Wordsmithing]].

	== Freeing up disk space ==		== Freeing up disk space ==