zoukankan      html  css  js  c++  java
  • Find out who the “mole” is?

    Blueheat Company’s  production server was out of order again. The CEO was very upset and want their CIO Leo to figure out what happened. Leo asked those IT guys to investigate what’s  going on but in vain. That’s a SUN SPARC server running Solaris 10 and those IT guys could not find anything unusual.

    The CEO decided to call the Police when that production server crashed again. Forensic  guy R started to conduct an investigation on firewall and security logs of that server to identify whether the attack was from outside or not. He found no threat from outside, and he thought  there was a “mole” in this company. That’s a serious situation. IT guys were familiar with those systems, and if one of them was the “mole”, it’s difficult to distinguish who was the mole or not only by checking daily operations.

    Blueheat had more than ten IT guys including Developers, DBAs, System Engineers, etc in IT department. They all needed to access server farms all day, and also they got permissions to acess server farms. So it’s difficult to identify what’s normal operations and what’s unusual operations. Forensic guy R decided to deploy monitoring script on that SUN SPARC server,and the monitoring script will record timestamp, source ip, user account, and any key stroke. Also it will send alerts to forensic guy’s mailbox automatically.

    Couple days later fortunately forensic guy R found a connection log on 2010/1/5 15:14. Guess what? The “mole” tried to edit a script and he/she disabled Samba service. He/she also took a look at the file “/etc/passwd” on 2010/1/5 15:14. Forensic guy R checked the DHCP log and found that IT guy Mr.A used that ip as exactly in monitoring log of 2010/1/5 15:14.

    Forensic guy R examined Mr.A’s workstation and found some scripts could do something bad to servers. Finally Mr.A confessed the crime he did and got caught.

  • 相关阅读:
    1.2 C++命名空间(namespace)
    1.3 C++引用(Reference)
    在ros功能包CMakeLists.txt中获取所在功能包的路径 便于添加第三方库的相对路径
    ubuntu14.04下搜狗输入法不能输入中文问题解决
    js对日期的判断
    Calendar用法随笔
    键盘事件
    onkeyup+onafterpaste 只能输入数字和小数点--转载
    导出数据到EXL表格中
    DENON AVR-X510BT 功放设置记录
  • 原文地址:https://www.cnblogs.com/pieces0310/p/4986148.html
Copyright © 2011-2022 走看看