4

I'm trying to diagnose an unexpected restart that I had recently and I'm just curious if this is possible.

9

Generally speaking, yes: if you have a flaw that leads to remote code execution with root access, you can do it.

As a matter of fact, it's possible for a specific flaw not to lead to a remote code execution but still lead to a kernel panic and server reboot.

Given the way you've phrased your question, however, I doubt you have the necessary knowledge to perform a postmortem on a system a detect this kind of attack: I would suggest you hire a security professional if you really want the system examined.

| improve this answer | |
  • 1
    It's also relitively rare for such a thing to occur. More likely a hardware fault that causes a kernel panic. Check to see if there's anything in the bios logs or if the number of processors or ram amounts detected has changed, had such an occurrence here recently when a memory board died. – Sirex Nov 24 '11 at 15:20
  • Well, this is a VPS server, so I don't think a hardware fault is the cause of it. I checked /var/log/messages and I didn't see anything unusual. – robinhoode Nov 24 '11 at 15:28
  • @Sirex: I agree: I would really consider it a "last resort" option as it is pretty unlikely. The question was, however "is it possible", not "is it likely" ;) – Stephane Nov 24 '11 at 15:31
  • 1
    Well, somewhere below all that virtualization I am sure there are some hardware hiding... – andol Nov 24 '11 at 15:32
  • @robinhoode: The fact that it's a VPS doesn't make it impossible for the "hardware" to be in cause: you can have a problem with your integration drivers, the host machine could have crashed or even requested the restart and any number of things could cause unexpected reboot without leaving much in therms of clue on the server itself. – Stephane Nov 24 '11 at 15:34
3

You need root access to restart a Linux server. If your root account was compromised and you have ssh enabled, then it's entirely possible for someone to remotely reboot your server. Judging by the quality of this question, I strongly recommend that you hire a consultant with the revelation experience if this is impacting production systems.

| improve this answer | |
  • 1) It's only happened once, so it's entirely possible there's a reasonable explanation for it. I'm just trying to rule out the causes that create paranoia. 2) Hiring a professional would easily blow our budget :) – robinhoode Nov 24 '11 at 15:31
  • @robinhoode then you really should reevaluate if you truly have the resources to do whatever it is you do. If you have customer info or credit card numbers, for example, you owe it to your clients to hire a professional and notify them if there was a breach. – MDMarra Nov 24 '11 at 16:51
  • It's not really my call. I understand your level of ethics, and agree with it. However, we aren't holding any seriously sensitive information (e.g. SSNs, credit card #'s, etc). – robinhoode Nov 24 '11 at 16:56
  • @robinhoode depending on where you are, you could be legally obligated to disclose data breaches to your customers, even if it isn't SSNs. Some locales require notification if any personally identifiable information is compromised. If you can't pay to have your services properly secured, you shouldn't be running them. – MDMarra Nov 24 '11 at 17:20
  • If it's a VPS then you don't necessarily need root access to the server, you just need to be able to access the questioner's VPS account so that you can trigger a restart of the VPS. – Mike Scott Nov 24 '11 at 17:21
2

Yes, but I would suggest that you don't take that into consideration yet.

Most attackers break into the servers for reasons such as:

  • Perform DOS attacks or C&C of other compromised servers.
  • Host copyrighted-infringing content.
  • Make political or societal statements by defacing web sites.
  • Perform additional compromises to remote servers to clients.

There is no real benefit for most attackers to break into the server just to reboot it. While it is possible, considering the motives of most intruders, it is more likely the issue is something else - either maintenance by the hosting provider, an outage or in the worse case, somebody accidentally restarting the machine and not 'fessing up to it. :)

| improve this answer | |
0

Of course, it is possible. Look at /var/log/auth.log to check any suspicious log.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.