forensic_analysis_on_a_linux_web_server(1).pdf

(1208 KB) Pobierz
Mathieu Deous – Julien Reveret
Forensic analysis of a Linux
web server
www.nbs-system.com
1
Agenda
Who are we ?
Performing forensic analysis on a compromised web server
What to search, where, how ? Logs but also dynamic analysis
What about privilege escalation ?
How has rootkit detection evolved ?
www.nbs-system.com
2
Who are we ?
•
Security guys doing
both offensive and
defensive stuff
•
Our company is hosting
3000+ sites in a private
cloud
www.nbs-system.com
3
Agenda
Who are we ?
Performing forensic analysis on a compromised web server
What to search, where, how ? Logs but also dynamic analysis
What about privilege escalation ?
How has rootkit detection evolved ?
www.nbs-system.com
4
Performing forensic analysis on a compromised web server
Some people think finding out what attackers did on a
server is an easy task since their activities are
« obviously malicious » :
- Sending spam
- Scanning /DoSing other servers
- Hosting phishing sites
But sometimes there can be days, weeks, months
between a compromise and illegal activities…
www.nbs-system.com
5

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin