Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

After being hacked companies often give numbers and details on how much of their data was compromised e.g "13K user and passwords".

After a possible intrusion how do you know what the hacker did in your server?

share|improve this question

closed as off-topic by MichaelT, Bart van Ingen Schenau, Kilian Foth, GlenH7, gnat Aug 12 '14 at 2:45

  • This question does not appear to be about software development within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

Might be better at security.SE – TheLQ Jul 7 '11 at 17:59
TheLQ i had no idea that one existed – amosrivera Jul 7 '11 at 18:00
Just for future reference, thats all – TheLQ Jul 7 '11 at 18:03
This question appears to be off-topic because it is a question best asked on Security.SE, but is too old to migrate. – user40980 Aug 11 '14 at 2:58
up vote 2 down vote accepted

Security Stack Exchange has a range of Questions and Answers in this area - you should have a look.

While post-incident forensics is quite a mature field, and I have managed a number of these, it is high cost, and most organisations take the sensible view of assuming worst case - the attacker could have accessed everything. A usual tack is to wipe machines and revert to a backup taken before the incident - but this can be very expensive in a large enterprise.

In terms of likelihood of identifying activities, if you are logging at the perimeter you can often find out how the attacker got in, but after that point, if they set up an SSH server or other encrypted channel into your network you will lose the detail after that.

For individual servers, you may have logs which can be trawled through (very time consuming) but if the attacker got root on these machines they could alter the logs to hide any evidence - which is why it is always recommended to log to a machine elsewhere which has a write once, read many filesystem (which means anything written there can never be deleted)

Layers of security do help in not only preventing intrusion, but in detecting it before it becomes a 'lift off and nuke from orbit' scenario.

As an interesting aside - many times when running a forensic analysis after an incident, teams find evidence of other, longer-term, well-hidden intrusions...worried, anyone?

share|improve this answer

Assume a worst case scenario. Examine your logs, figure out everything they might have gotten access to, and assume they took a copy of all of it.

share|improve this answer

Hopefully their activity is logged and you can analyze what they have done. Otherwise, without any sort of trace of their activity, it's hard to determine what could have been done. I would always assume the worst, but hope for the best. Usually companies report the worst case intrusion to alert their customers to what may have been compromised.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.