The tag has no wiki summary.

learn more… | top users | synonyms

298
votes
12answers
52k views

How do I deal with a compromised server?

This is a Canonical Question about Server Security - Responding to Breach Events (Hacking) See Also: Tips for Securing a LAMP Server Reinstall after a Root Compromise? Canonical ...
10
votes
3answers
851 views

Finding how a hacked server was hacked

I was just browsing through the site and found this question: My server's been hacked EMERGENCY. Basically the question says: My server has been hacked. What should I do? The best answer is ...
9
votes
10answers
969 views

Pull network or power? (for contianing a rooted server)

When a server gets rooted (e.g. a situation like this), one of the first things that you may decide to do is containment. Some security specialists advise not to enter remediation immediately and to ...
0
votes
2answers
321 views

Strange Items in Hosts File and Netstat

I ran a netstat -a on a computer and there were a number of strange items: Proto Local Address Foreign Address State TCP netgym:epmap virusin:0 LISTENING ...