Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

With the news of Google and others getting hacked, I was wondering how companies find out, detect, and/or know they've been hacked in the first place?

Sure, if they find a virus/trojan on user's computers or see a very high access rate to parts of their system that don't usually see much, if any, traffic. But, from what I've see in articles, the attack was pretty 'sophisticated', so I wouldn't imagine the hackers would make it so obvious of their hacking in the first place.

Maybe someone can enlighten me on current detection schemes/heuristics. Thanks.

share|improve this question

migrated from stackoverflow.com Jan 20 '10 at 6:02

This question came from our site for professional and enthusiast programmers.

    
When did Google get hacked? Can you provide your source of information? Thanks. –  joeqwerty Jan 20 '10 at 12:23
1  
    
@Zypher: Thanks. –  joeqwerty May 14 '10 at 1:30
add comment

5 Answers

Generally they look for subtle forensic clues; such as their homepage being changed to a banner which reads "p0Wned by TeH L33t Krew!! haahah1h1!! u noobs"

share|improve this answer
    
LOL - nice way to start the day :) –  Olaf Jan 20 '10 at 9:30
    
+1. Too funny... –  joeqwerty Jan 21 '10 at 0:05
    
+1 this answer is win. –  GruffTech Apr 28 '10 at 18:22
    
+1 for making my day –  Mitch Dempsey May 14 '10 at 1:30
    
+1 For the lolz –  Brad May 14 '10 at 1:57
add comment

A successful hack is one that goes undetected ;)

A sysadmin can set up honey pots, dummy computers to fool hackers into thinking that they're a real system with real data. In the honey pot all activity is monitored and the behaviour of the hacker is studied to help learn more about what a hacker or virus is trying to do to help security experts figure out how to prevent future intrusions.

They can also use automatic Intrusion detection systems to help them detect suspicious activity

share|improve this answer
1  
Under a real attack scenario, hackers frequently use some decoys and flood to make the IDS report false alarms, and in the same time they performs their attack with a very much less aggressive timing, IDS needs experienced admins. –  Maxwell Jan 20 '10 at 8:25
add comment

They won't know it if it is well done or if they have not the internals skills and practices. For discovering that a hack has been performed, some measures (i'm not exhaustive here) needs to be implemented such has auditing files change, collecting IDS logs and performing a deep analysis with multimple hosts correlations.

Furthermore, a determined person will certainly after gathering as much as possible informations about the target will try to use social engineering in the first place because users are generally the weakest link in the security chain.

share|improve this answer
add comment

I would guess that most of the high publicity hacks we hear about start with either the company, or the media, being tipped off by an end user that someone has messed with their account/stolen their identity/etc.

Then the company reacts to this, goes through their logs to try and discover the extent of the problem and what happened, patches the hole, etc. and then (probably) issues a press release and tries to contact affected customers.

But yeah, I would guess that it's often an affected end user that tips them off.

share|improve this answer
add comment

How to detect it depends a lot on what it is you're serving. As part of our backup system I have a script that mirrors the our company web sites to an internal server, transferring only what has changed. At the end of that the script parses the logs looking for any changes, additions or deletions and sends me an email if any are found. That way, even if there is a less than obvious change, I will (should?) find out about it. Of course the script lives on the internal server, not the web server.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.