The fastest way to detect whether Unix is ​​hacked

It takes higher skills to identify whether Unix systems are hacked, and of course there are some very simple methods. The simple way is to check the system log, process table, and file system to see if there are some "strange" messages, processes, or files. For example: Two running inetd processes (should be only one); .ssh runs with root's EUID rather than root's UID; Core files of the RPC service under "/"; New setuid/setgid program; documents that grow rapidly in size; The results of df and du are not similar; The monitor of perfmeter/top/BMC Patrol/SNMP (the above are some monitoring programs) does not match the results of vmstat/ps, which is much higher than the usual network traffic; Normal files and directory entries under dev, especially those that seem to have normal names; /etc/passwd and /etc/shadow, are there any abnormal or password-free accounts in the area; The strange file names in /tmp, /var/tmp and other directories with writable permissions refer to strange files. The strange ones here refer to (3 dots) whose names are similar to "...". If you find such a name, but it is actually a directory, then there are most likely problems with your system. Also pay attention to check /.rhosts, /etc/, /.ssh/known_hosts and ~/.rhosts to see if there are any inappropriate new entries. In addition, pay close attention to those hidden trust relationships. For example, how are hosts mounted on NFS? Which host has .hosts, .stops and entries about other hosts? Which host has .netrc file? Who does this host share the network segment with? You should continue to investigate it. Usually attackers do not just destroy one host, they jump from one host to another, hide their traces and open as many backdoors as possible. If you have any suspicious findings, please contact your local computer emergency response team to help check other hosts on the network and restore damaged sites.

Latest Comments