JACK: Hey, it’s Jack, host of the show. A long time ago I set up a file-sharing website at
home on a Raspberry Pi. I set it up to make it easy to transfer files between me and anyone I
needed to send files to. It was a simple website; drag and drop the file onto the webpage and boom,
it’s hosted on my website for like, a week, and then it gets deleted. I knew it wasn’t secure
so I never posted anything that was sensitive to it but I also took this opportunity to see
if I could detect anyone trying to hack into the thing. I set up all my best sensors I had at home;
a firewall, an intrusion detection system, full packet captures using Security Onion, I turned
on tons of logging and watched but nothing happened. Nobody knew my site existed to even
think about trying to exploit it. Oh, well. I forgot about that little website for years
but last week I went to check on it and there was a suspicious file uploaded not by me. [MUSIC] I
checked into it and whoa, someone uploaded an exploit and gained access to my Raspberry Pi.
A hacker was in my house. Okay, jeez, quick, what do you do? Perhaps some people would feel
freaked out, violated, or get anxiety because it’s scary knowing someone is in your computer looking
at your stuff. You have no idea who they are. But me, well, I stayed calm because I expected
this to happen so I isolated the whole thing on its own network and it just wasn’t possible for
them to move to any other computer or get anything good off this Raspberry Pi. You could say this was
sort of a honeypot. I traced their footsteps and looked at everything they did.
Pfft, amateurs. They used an off-the-shelf PHP script to exploit the thing. They didn’t cover
their tracks. They checked a few directories looking for anything good. This server had
nothing, not even a database. They tried getting the root and hopping to some other devices in the
network but yeah, no luck. This system wasn’t even allowed to connect to the internet so they left.
Yeah, not really that exciting. I turned that Raspberry Pi off and reformatted the SD card.
But you know what? I did learn something cool along the way, and we’re gonna get into a similar
story today that I think you’ll learn something interesting too, on what to do when this happens
in an important network. JACK (INTRO): [INTRO MUSIC]
These are true stories from the dark side of the internet. I’m Jack Rhysider. This
is Darknet Diaries. [INTRO MUSIC ENDS] JACK: [MUSIC]
Okay, so this is another Mini-Stories episode. There are three stories in one. These are stories
that are too good to pass up but not long enough to make into a whole episode. There are a few cuss
words in this one, just to let you know. Alright, so let’s call some hackers. [SKYPE CALLING]
Hello? DAVE: Can you hear me?
JACK: This is Dave Kennedy. He’s quite known in the InfoSec space. He’s built some highly popular
hacking tools and helped start DerbyCon which is a popular hacking conference in
Kentucky. But probably the thing he’s most proud of, his crowning achievement…
SEAN: Hi. JACK: …is this.
SEAN: How are you? ELLIOT: One second,
just finishing up an e-mail. JACK: This is a clip from Mr. Robot.
Elliot, the character in the show, is trying to hide from someone and slips into a conference
room and tries to social engineer his way into a meeting that’s in progress.
ELLIOT: We should get started. SEAN: I think you’re in the wrong room.
ELLIOT: I’m sorry, you are? SEAN: Sean, head of sales.
ELLIOT: Sean, of course. Dave Kennedy. I work with Craig on the Q4 push.
I had longer hair, then. JACK: Hah. There’s no coincidence that
Elliot uses Dave Kenney as his fake name while trying to social engineer his way into this thing.
It’s because Dave is a social engineer master. Dave’s reputation precedes him. So, how does a
big-time InfoSec guy like this get started? Playing video games in high school.
DAVE: I was programming MUDs back then and I was one of the guys that ran the actual
MUD and kind of promoted it and grew it and everything else. That’s where
I started learning some C and C ++. JACK: MUD stands for Multi-User Dungeon.
Think of it like World of Warcraft but with absolutely no graphics. It’s all text-based
but still online where you can group up and quest, and raid, and fight everything. He
realized college wasn’t right for him after high school so he decided to join the army. [MUSIC] He
headed down to the army recruiter’s office. DAVE: The guys just didn’t seem very happy there
and I’m like man, why would I want to join this if the folks that are trying to recruit me aren’t
happy about their jobs or what they’re doing? I was actually walking out; I’m not even gonna join
the military and I saw these four really buff marines walking in-sync and they’re wearing the
dressed blues and just looked sharp as heck. I was like man, I want to be like that. I walked into
the marine recruiting station and I was a really overweight kid and didn’t have a lot of physical
fitness or anything like that. I said hey, [00:05:00] I want to become a marine.
I tested very highly on the ASVAB which is the aptitude test for the military. What was great
about the Marine Corps is they guarantee your position and I wanted to do something
like hacking and wanted to get into more of the intelligence side of things. I was able to go into
the military intelligence side and work in signals intelligence which was a ton of fun.
JACK: He was stationed in Hawaii in Ford Meade and did two tours in Iraq. He got to do fun stuff like
forensics and research and cyber-warfare. He got out of the military and joined a small consulting
shop. Back then penetration testing and security in general was in its early stages. Social
engineering, the deceptively benign-sounding name for tricking people into giving up their
passwords, that really wasn’t that big of a thing yet. Web applications weren’t really getting that
much attention from the security professionals. Dave headed up the penetration testing division,
then eventually became the VP of consulting and it was at this, his first job, where he
learned a lot of new skills and different programming languages like Python.
DAVE: Then I had a really great opportunity hit me to be the Chief Security Officer over at Diebold
which at the time I think I was like twenty-six or twenty-seven years old which was awesome,
being a VP of a – security of a Fortune 1000 company. Really had no idea what I was doing but
it turned out to be a really, really awesome position. I learned a ton from that.
JACK: Twenty-seven and the VP of a Fortune 1000 company? Whoa. He was
young and motivated to learn. He picked up all kinds of skills that he used to then start up
his own company which he called TrustedSec and then he started Binary Defense.
DAVE: TrustedSec is a information security consulting company. I started it literally in the
basement of my house, and Binary Defense as well. I started Binary Defense and they’re both two
different companies, two separate companies, and I did that for a very specific reason. Consulting
is very specific and I didn’t feel like we could be the same company doing the same work and also
doing the monitoring, detection of an organization as well, like giving heads up or making ourselves
look good when we’re doing an assessment. I really split the companies up early on. I
think we have about 162 employees now. JACK: The story we’re talking about today is
about an assignment with TrustedSec. For this engagement, the client was a large retail company
with retail stores all over the US and they wanted Dave to test the security of the store.
DAVE: [MUSIC] We had a few objectives; one is to be able to steal stuff from
the store. The other objectives were to get access to the corporate headquarters.
JACK: Steal stuff from the store is actually going into the store
and grabbing stuff off the shelves? DAVE: Oh yeah. Yeah, absolutely. As well as
could you get access to the back-store area where they have the point-of-sale systems and
the base servers. Could we get into them and plant stuff in? It was a lot of fun.
JACK: If you think about it, this type of work is simply quality assurance. Companies have been
doing quality assurance testing for decades, making sure their product is within spec. Now
in the modern age, the way some companies test quality assurance is to hire a bad guy
to see how good their security is. DAVE: We did some reconnaissance ahead of
time. We went to the store, purchased a couple of things legitimately, went to a different store,
looked at who the employees were, how they operated when they took lunch breaks, the least
amount of personnel during times. We had all of that kind of mapped out for when we were
actively going after this organization. JACK: While he was there, he noticed these stores
all have LP. You know what LP is, right? It’s Loss Prevention and it’s typically a person
standing near the front door of the store watching every customer coming in and going out to prevent
people like Dave from stealing things. First, Dave got to test how good their LP is.
DAVE: If you come in wearing a suit, you’re pretty much not going to be looked upon. You come in
dressed up as a – ripped jeans and dirty hair, or something like that, I don’t know, looking
suspicious, looking to your left and right; maybe that’s a way that you get identified. But for us,
we usually come in looking professional and looking in a way that we’re not suspicious. We’re
not looking over our shoulders. We’re not looking nervous; we’re looking like a customer. We might
actually buy some things with cash just to throw everything off. It’s more so just trying to be
and act like you play a part of that role and that you fit. We just started
grabbing a bunch of things from the store, shoved them into our backpacks.
JACK: During this time, the LP is looking for shoplifters but Dave brought help to handle that,
a second person to distract the LP. DAVE: It’s very difficult to keep an eye on
everybody that’s in the store so there’s only a finite amount of personnel. If you can do some
distractions in different locations that have much lower levels of personnel, you have a much higher
percentage of being successful. Things that can take time away from the person, like if we have
two people, we can do a diversion for one; have them communicate and talk. The other person’s
doing nefarious things. That works out really well with us when we have two people doing it.
JACK: At this point, Dave has a bag full of stuff he stole and is walking around the store.
This is a multi-floor store so he goes up to the second floor
and he even goes up to the third floor. DAVE: When we walked in the store, it’s just
a regular person. [00:10:00] When they weren’t looking, we just went into the back. [MUSIC] We
were basically in the back for I don’t know, twenty minutes, thirty minutes. We have these
little devices that we call TAP devices that have cellular communications so we don’t have to worry
about the firewalls but it still allows direct access to their network. We plug that into another
network that has two ports on it. Just unplug the one Ethernet cable, plug the other one in,
and then was able to basically have direct access to their back-end infrastructure,
their card-holder environment and the retail’s enterprise network.
JACK: Okay, he’s stolen stuff and now tapped into the network and got access into their back-end
infrastructure through this network port. DAVE: They had iPads for cashing people out and
things like that. We took two of the iPads. JACK: Jeez, Dave is on a roll here. Now they have
access to customer credit card information and internal company data. They came out from
the back room to see what other things they could take from the store.
DAVE: Then we saw the cash register and it was on this podium. We just had one of our
folks – there was two of us. One of them was just basically asking about a bunch of stuff.
JACK: He was distracting the LP. DAVE: I basically took a screwdriver and
removed it from the back, unbolted it from the thing and walked out with the cash register.
This is a big cash register; this isn’t like a small thing. I took the whole cash register
with all the money inside of it. I mean, it’s extremely heavy. I carried that out, literally,
and walked out of the store without anybody – one of the employees looked at me and kind of looked
at me weird but then I just kinda waved and walked out and that was the end of the story. We walked
out, got in our car, and drove off. JACK: Dave walks out of the store with a big
old heavy cash register full of cash, two iPads in his backpack, and a ton of other
store merchandise. Unbelievable. DAVE: You know, it’s a rush. I get nervous
every single time I still do it. JACK: Dave now tries to test another store
to see how they’d handle him. DAVE: For one of the stores, we called
ahead and we spoofed our number coming from the corporate offices and claimed to be one of their
main IT folks, and that we were going to be doing an upgrade to the store location
for faster bandwidth and everything else. They were super excited about that so they let us
right in. We had fake business cards. JACK: This is one of Dave’s specialties; social
engineering, spoofing phone numbers, acting like IT from corporate office. He’s a master at this.
When he did this, it worked like a charm. They escorted him right into the back room, showed him
the computers, and left him there unsupervised for thirty minutes while he hacked into the network.
Again, unbelievable. Dave explained to the head of security how they could get into
everything so easily and this kind of shocked him. They wanted Dave to now test the security
in their corporate headquarters to see if they could break into the data center there.
DAVE: Here’s where we actually got busted. It wasn’t the store
location that didn’t have the most amount of security; it was the enterprise location that
didn’t have much security at all. JACK: First, they had to figure out how to
get into the building of headquarters. DAVE: What we did is, we looked at the front
location. The front location, you had a lot of people badging in. However, one of the side doors,
people could just walk out. You didn’t see anybody walking in but you could see people walking out,
especially during lunch and dinner, things like that. During lunchtime, we waited outside and
saw somebody walking out and we just pretending to be on the phone. We’re dressed up in a suit.
As soon as the door was about to close, we grabbed it and we walked right in. It was really
easy to get into the building itself. JACK: [MUSIC] It’s easy for Dave because he
knows all the tricks and has done this a bunch of times. When you do something a lot, you get
pretty confident with what you’re doing. DAVE: You just walk around like you belong.
You walk around, you pretend that you’re on the phone. You’re with somebody else,
you’re pointing at something, you’re pretending that you’re having a meeting.
You just keep walking around the building until you find the objectives that you need.
We found the data center. The data center was locked and there wasn’t a lot of traffic,
especially during lunchtime. We went to this conference room which was a
conference room tucked away on the side. JACK: They sat down and acted like they belonged
there. From here, they planned their next steps. They wanted in the data center but that door was
locked and chances are, it’s harder to piggy back into a data center and just follow someone else
in. But a good social engineer doesn’t always have everything planned out. Sometimes they
just have to take it step by step, see how far they can get, and then figure out what they can
do from there. They looked around to see what they could use in this conference room.
DAVE: There was a conference bridge on there, like a phone there. We called from the bridge and I
called the data center number. The way that I was able to do that was first calling the receptionist
first and saying hey, what’s the data center’s extension? They gave it to me, then I called the
extension. Before we called the extension, we did some research on individual people in the company
and I found a person in IT that had access to the data center so I called this phone.
I’m like hey, let’s say his name’s Bob. I’m like hey, it’s Bob, I’m here with a bunch of auditors
for PCI work. They need to do just a quick site audit of the data center. Could you let them in
just so we can get this last part of this compliance thing taken care of for the
Payment [00:15:00] Card Industry? Threw out a bunch of acronyms, things like that. The person
at the data center was like hey, who did you say you were again? I’m like oh hey, it’s Bob.
Just trying to get this audit done. He’s like I’m best friends with Bob and you’re definitely not
Bob. I don’t know who you are or why you’re calling from a conference room that’s downstairs,
but something’s not right here. JACK:
Shoot, he’s been caught. Of all the people to impersonate, he picked someone that person on the
phone actually knew. Quick, what do you do? DAVE: We rushed out of the building really
quick before we got busted. JACK: Dave escapes and that’s always the
second objective to a social engineer if they get caught, to try to escape because part of this is
testing their incident response. Their response was pretty poor if they let Dave get away.
But Dave’s objective was not complete. The company tasked him with getting into the data center so he
needs to go back and try again. But now on one hand, he knows more about the location
and on the other hand, it might be trickier because maybe they’re on high alert now.
DAVE: We rebroke back in two days later, same method for piggy-backing,
and then we waited past lunch until everybody came back and we just sat.
There was a little break room right outside the data center and we just sat and watched who had
access to the data center and who didn’t. JACK: [MUSIC]
They noticed to get into the data center, you need an RFID badge. This is one of those proximity
cards where you swipe a credit card-looking thing near the door and it unlocks the door.
Well, they came prepared for that. DAVE: We’ve created our own custom backpacks
that are over-amplified and we can usually get a little bit of distance, a few inches
away from an individual and their badge and be able to collect. We can just walk past somebody
and clone their badge and be able to replicate it. We can clone as many you want to. We can actually
imprint new badges. What we usually do is we’ll get pictures from outside the facility of their
badges and then we have a printer in our car; it’s like a portable printer. We’ll print badge IDs
that look like theirs as well, with our pictures on it. Then we’ll just imprint those badges
with their identification and their badge cloning. Just by walking past them you can literally just
clone a badge, as many as you want to. JACK: They do just that. They prepare to use their
RFID key card cloning machine to walk past someone coming in or out of the data center, clone it,
and then go make a copy off-site. As they’re watching people go in and out of the data
center, they pick someone, a mark. DAVE: We’re able to walk past the person,
grab them and say hey, I’m a new employee here, blah, blah, blah, just ask a bunch of questions.
We cloned his badge at the same time. JACK: Success, they got the digital key they
need to get into the data center. They need to leave and go print
it on a badge. They pack up and head out. DAVE: Came back at night, badged ourselves in, and
got into the data center that way. We signed in as we were supposed to ‘cause there was somebody
in there. Didn’t even question us or ask us, just kind of looked at us. We signed in, they went back
to their computer, and then we essentially had free access to roam the data center. What we did
is we placed another TAP device in one of the core networking switches which gave us – we confirmed
the DHCP and we were able to communicate with different things. Once we had that,
we essentially had direct access to their entire environment; took pictures, and selfies, things
like that. There was actually a bathroom in the data center which I thought was really weird, so
we used the bathroom. Then we walked out. JACK: Mission accomplished. Feels good. But
Dave is in a funny place because when he’s successful, it means his client’s security
wasn’t strong enough. It sort of means he has to go to them with bad news.
DAVE: It’s almost always shock. They assume that they have problems or exposures
but they probably don’t realize to what extent that is. Our job isn’t to say listen, you’re
doing all this wrong. Our job is to highlight the things that they’re doing well, as well.
Here’s the things that you did well and here’s the things that actually thwarted or stopped
us. Here’s the things that you do very good and here are some of the things that we identified
that are really good for you to address based on criticality or risk towards your organization,
and here’s how you address them. Here’s how you fix them. It’s not just about smashing
and grabbing and being an awesome hacker and doing all these crazy things. It’s really about making
the customer better, making the people that you’re testing better in the long run.
I think that’s really important that we lose a lot in this industry of,
is that most folks just focus on hey, I’m the best hacker in the world. I just destroyed everything.
Good luck. Then kinda leave it there, whereas as an industry, we really have to focus more
on the teaching aspects around hey, how do they actually fix this, how do they actually address
it? What are the things that they could do to get better and make it harder for attackers to get
in? That’s really our ultimate goal. JACK: Dave met with the company and coached
them how to shore up their defenses. As you may have guessed, this episode and past episodes,
those RFID badges, yeah, they’re vulnerable to cloning which makes it easy to bypass those locks.
Some companies have moved away from using badges like this and have switched to something else
like maybe a magnetic stripe card which has its own weaknesses but it makes cloning it a
little bit harder. [00:20:00] Other companies require a biometric ID to get into doors,
so like a fingerprint or an eye scanner. I’ve been in a big data center that did all
this and more; an RFID badge just to get into the parking lot, a pin to get into the building, then
to get into the data center area in the building you had to swipe a magnetic card, enter a little
chamber which weighed you, and then did a retina scan and then allowed only one person through at
a time with a guard watching every single person coming in and out. Then to top it off, I needed
an old-fashioned, regular key to get into the actual cage where my client’s servers were. Oh,
and as a side note, I thwarted all this security a few times and snuck my girlfriend in without going
through any of this but that’s another story. Dave gave a bunch of tips to this client.
DAVE: When we debriefed them, we worked with them again the next year, and they had really
taken the results and addressed them. They ended up switching to a different solution and away from
proximity cards. They actually did a technology improvement and enhancement and put also
additional controls in place like instead of that back area being there, you had to go through
mantraps and things like that to get in and out of the building. They did a really good job and
we actually got busted the year after that in both the retail location store as well as the corporate
headquarters. It was a good success story. JACK:
[MUSIC] Yeah, might as well start out with your name and what do you do?
CLAY: My name is Clay. I am an InfoSec engineer. I work at a university
so I’m InfoSec for an entire school. Yeah, we have a lot of Linux machines. We’ve
also been migrating a lot to the Cloud. JACK: Clay does a lot of IT work for this school,
this big university, ranging from anything from coding to system administration,
web app security, setting up the network, and even doing penetration tests.
CLAY: I also help generate best practices if they have – if sysadmins or programmers have questions,
they can come to me and if I don’t know the answer off the top of my head,
I do the research and get back to them. JACK: One of Clay’s responsibilities is to take
care of threats that are found in the network. One thing he battles a lot with is…
CLAY: Cryptominers. [MUSIC] Being in this environment, in academia, it’s really hard to have
all of the systems on the network managed. JACK: A managed system is just a computer that
Clay is aware of and can access, and somewhat control. An unmanaged computer on the network,
Clay has no control over it and may not even know it exists. Obviously if you’re a system
admin, you want to be able to access all the computers on your network but at the same time,
it’s impossible to manage every computer at a university; students bring their own devices
into the network all the time. But yeah, something Clay battles with frequently is cryptominers. This
is where a student might install a Bitcoin miner on a computer in the lab or in a research center,
and then the Bitcoin miner will consume a ton of CPU or graphics processing to try
to generate some crypto-coins and automatically get deposited into the student’s wallet, and will
actually get an alert when this happens. CLAY: We have an IDS in place. That’s typically
how we’ll be notified of these events. JACK: An IDS stands for Intrusion Detection
System. This is a device that inspects every packet coming in or out of the network and checks
to see if that packet matches any known signature for some kind of security issue. In this case,
it matches the signature for cryptomining because when it connects to the block chain or pools,
or whatever, it then recognizes this as a miner and triggers an alert.
CLAY: Yeah, then the fun begins. We can isolate the machine, usually myself and a sysadmin just so
we have two pairs of eyes. It’s always better than one. We’ll go and we’ll start the investigation.
We’ll look at running processes, we’ll look at the bash history, things like that. We’ll
look at open ports. [00:25:00] If it’s like running netstat, we can see if it’s listening or
if there’s a connection that is established. There isn’t always
but yeah, we look at all those things. JACK: It’s fun because when detecting something
as wrong in the network and then you find it and isolate it and squish it, it’s just exciting.
As a sysadmin, most of your job isn’t tackling live security issues so when it’s happening,
it is exciting. Honestly, it’s always fun to catch someone in the act that’s doing something
they shouldn’t be doing and go and bonk them on the head and tell them not to do that anymore
because they’re usually blown away that you’ve figured out it was them. This paints a picture
of what kind of stuff Clay works on. But Clay also sometimes does this on the side a little. He
has a few clients and he helps secure their network. When they have an issue, they call
him up. One day, they gave him a call. CLAY: This was just a normal day at work. I
got an e-mail from the client. Something doesn’t seem right; something doesn’t look
right. The application is acting kind of funky or something’s off. I’m like okay well, let me grab a
cup of coffee and come and check it out. JACK: Basically, one of the faculty or staff
at the school was complaining about a slow website which was running Linux
which is a server that Clay can access and check into. The Linux server runs this website and Clay
looks around at the thing. He’s checking things like does the website load? Yeah, it does. It’s
working okay. Is the server running high CPU or is low on disk space? No, that’s fine, too.
Things seem okay and maybe a junior-level sysadmin would stop here and just try to let it sort itself
out or reboot the machine and be done. But Clay is not a junior sysadmin. He’s a senior security
engineer so he takes another look. CLAY: [MUSIC] I want to see who’s logged in,
if anyone is logged in. JACK: He checks here to see if any
developers are in there messing around or another sysadmin doing something or
anyone fiddling with this. He doesn’t see anyone else there so he does his usual rounds.
CLAY: [MUSIC] Is the database up and running? Is the VPN up and running? How does that look?
Just standard stuff, right, looking over the whole application site, making sure things are running,
doing a quick top making sure nothing is running extremely high, taking up a lot of load, using
a lot of memory, those sorts of things. JACK: At first glance all this seems okay still.
But then a second look through everything, he
finds something. CLAY: I found
that there was a root shell open. JACK: [BEEPING] A root shell is open on this
server. Let me explain; on Linux, this super user or administrator is called root. [MUSIC] This user
account has full privileges to everything on the server. What Clay sees is that someone is logged
in as root. Having a shell is another way of saying someone’s logged into the command line.
Now, you and I might think oh, it’s just another administrator doing work, but the school has set
up the network correctly. See, it’s not good to allow anyone to log in as root because
you have no idea who that is logged in as root, and every hacker on the planet knows this username
exists and will try to brute-force the password to it if you give them a chance. The school set it up
so that individual users like Clay’s username, has access and admin capabilities and super user
privileges. Clay knows that under no circumstance should anyone ever be logged in as root, but here
there is. Someone is logged in as root. CLAY: I immediately start thinking to myself,
oh crap. We do have a compromise. It is a root-level compromise. Now
my heart starts pounding a little bit stronger and I start thinking well hell,
what the hell do I do next? JACK: Okay, so in the physical world
this is equivalent to coming home and seeing your front door is wide open and there are muddy
tracks leading into your house. The feeling of discovering someone is in your server
that shouldn’t be there and for them to have root level access to it is really, really scary.
CLAY: I looked to see how they got in and block it. Do I just sever the
connection and hope they don’t come back before I can patch the stuff, or what? All of these
thoughts are just racing through my mind. JACK: Clay takes a step back, and a deep breath.
All of a sudden, he’s hyper-focused on this issue now. Anything else that he was
thinking about doing that day is no longer in his thoughts. This is all he can think about.
CLAY: I said well, the best thing to do is determine how the hell they got in and try
not to make a lot of noise on the system while I’m doing this because I don’t [00:30:00] know
if they’re active, if they’re like sitting at the shell actively looking at stuff,
or if they just have a shell open and it’s in the background. Or maybe that shell is just
waiting for a command or something. I don’t know exactly what’s going on so I want to be careful
and I want to go slowly, and I want to find out what the hell happened.
[MUSIC] Being a web application, I knew it had to be probably
SQL injection. Cross-site scripting thing probably wouldn’t lead to this level of compromise,
at least not right away. I started looking at the database.
JACK: This web server was running an SQL database. This is where all the data is
stored for the website. Clay was looking at the history of commands executed in the database,
trying to find anything unusual. CLAY: I started looking at some of the pages that
used the database more heavily than others. I did start to notice some weird shit in the database,
in some of the tables. I was able to isolate it to one of two pages that had this vulnerability.
I visited those pages and they looked okay; nothing was out of whack or funky.
No errors were being displayed or anything like that. I thought let me just move these files
and move them out of the way so they’re not accessible anymore.
JACK: Clay determined that a couple of pages on this website were probably
where the hacker got in, so he just took those pages offline, making it so further intrusions
couldn’t occur. Removing how this person got in is one thing, but it doesn’t remove them
from your server. The root user was still logged into the server but if Clay kicks them out now,
they probably couldn’t get back in. CLAY: Tried to su the root at some point
during this whole thing and I couldn’t. I knew they had changed the password.