Howdy malware fighters,
In light of Incident Handling, I thought it would be good to start with Step 0 and that is Detection. Before you ever begin your incident handling process, you have to know you are compromised. Sometimes it’s readily apparent and sometimes it isn’t.
Go here and check the ten signs: http://isc.sans.org/diary.html?storyid=5095
Starting with 0 and what you learn at this forum site is, learn how to detect malware on your box or an attempt to compromise your box. And now the other ten signs:
- Your logging server hasn’t logged any events or you haven’t received alerts in the last 12 hours
- Your FTP server/user hard drives etc. are suddenly out of disk space or maybe logs increase in size more than your normal variation
- Your competition’s products looks just like yours, but have a prettier color scheme
- Your customers start receiving spam on email addresses they used only to sign up for your service
- You get machine acts “funny” report from users (i.e. windows closing by themselves, browser homepage changed, etc.)
- Someone needs help connecting to the company’s wireless access point, you don’t have a wireless access point
- Complaints that software (payment processing software, web browser, etc) keeps crashing
- Complaints from user(s) that passwords/logins aren’t working
- Computer systems running unusually slow
- Visitors to your website complain that they get redirected to another site or one that just doesn’t “look” right
If you have other indicators that you have encountered in the past that have clued you in to a compromise, please let Polonus know and he’ll update this Sans Internet Storm Center’s list,
pol