Responding to a Security Incident

By now, nearly everyone who has been using Linux for some time and had their system connected to the Internet has seen attempts to compromise their security. The question that often comes up is what to do about it. Unless it's a financial or safety issue, it's probably going to get laughed at by the legal authorities, but it's worth reporting.
Now What?

So, what will happen now? Should you sit back and wait for the ISP you just contacted to report back, "Wow! We got rid of that user!" Think you're going to break up a large international ring of hackers trying to take over the Pentagon?

Think again.

You'll be lucky to get any notification that your memo was received, unless it's an automated reply. You'll probably not get any followup done, either, on their end. So why bother?

Rarely do potential attackers work just on you. Unless you hang out on the Internet and antagonize people for a hobby or a living, chances are they're not targeting you, but they're doing wide sweeps of the Internet to find vulnerable hosts. What you've done is provide the ISP with data that says "They were here, too". This is why you bother. If enough people complain they'll see it's a real problem and probably fix it.

Remember, the ISP staff are busy people. Routers explode, billing situations come up with their customers, new hardware has to be installed, in short, they have daily business to take care of. Their response will be tailored to the severity of the incident. One port probe on one machine is nothing for them to worry about. If you can demonstrate it was a network-scale issue or a recurring problem, then they may start to care.

So, carry on with your network activities, keep a watchful eye out for problems and improve your defenses as needed.


The SecurityFocus INCIDENTS list is an excellent mailing list about security incidents. Sit back and learn.

The SANS GIAC effort is also a good place to learn about detects, what generates them and the like.

The GeekTools Whois Proxy is my favorite method of searching for domain information about a hostname, a network name or even a numerical address. It's smart enough to hit the right servers for information. You can also download the source and run your own local instance.

Documentation on using TCP_wrappers and general Linux hardening can be found at

Using grep on your logs will make your life a lot easier. A good piece of documentation on it is at

Two books in investigating computer crimes for a legal standpoint are:

Criminalistics: An Introduction to Forensic Science by Richard Saferstein. Prentice Hall, 1998.

Investigating Computer Crime by Franklin Clark and Ken Diliberto. CRC Press, 1996.


One Click, Universal Protection: Implementing Centralized Security Policies on Linux Systems

As Linux continues to play an ever increasing role in corporate data centers and institutions, ensuring the integrity and protection of these systems must be a priority. With 60% of the world's websites and an increasing share of organization's mission-critical workloads running on Linux, failing to stop malware and other advanced threats on Linux can increasingly impact an organization's reputation and bottom line.

Learn More

Sponsored by Bit9

Linux Backup and Recovery Webinar

Most companies incorporate backup procedures for critical data, which can be restored quickly if a loss occurs. However, fewer companies are prepared for catastrophic system failures, in which they lose all data, the entire operating system, applications, settings, patches and more, reducing their system(s) to “bare metal.” After all, before data can be restored to a system, there must be a system to restore it to.

In this one hour webinar, learn how to enhance your existing backup strategies for better disaster recovery preparedness using Storix System Backup Administrator (SBAdmin), a highly flexible bare-metal recovery solution for UNIX and Linux systems.

Learn More

Sponsored by Storix