Some of the UNIX tools that come bundled with most UNIX operating systems or that are freely available on the Internet and are worth familiarizing yourself with include: Various software tools and UNIX commands can help you gather this information. Geographic locations of suspect IP addresses.Accurate dates, timestamps, and images of evidence.Key items you’ll want to look at and retain for analysis are: Whatever tools you decide to use for analyzing evidence should all be freshly installed. For example, the ps program that displays the process table could have been replaced with a Trojan ps program that displays everything except the process of a running hacker daemon. In forensic analysis, you cannot use any tools that are currently installed on the hacked system, because it is possible that those tools could have been replaced with Trojan programs. One method of gaining this information is by using tried-and-true UNIX networking tools usually employed in incident-response forensics. Data such as the hacker’s location, the domain and IP address from which the hacking took place, the name of the hacker, and what specific damage the hacker inflicted are all necessary for prosecution. But if you can identify the hacker and opt to prosecute, you must gather as much information about the attack as possible. Most organizations decide to close the holes as quickly as possible because the probability of actually catching an intruder is very low. Identify the perpetrator and prepare for prosecution.Close the holes as fast as possible and put in safeguards from future attacks.There are two standard approaches on what to do next: You have determined that your network has been breached. Take a look at how you can use Linux command line tools such as tcpdump, dig, and traceroute for security auditing. Old-school UNIX tools help track down hackers
0 kommentar(er)
