Being Prepared for Intrusion
By Dan Farmer and Wietse Venema
, April 01, 2001
As every good programmer knows, software will eventually fail—no matter how well it is written. The same applies to systems, networks, and security mechanisms; and a system that is prepared for failure has safety nets in various places.
Apr01: Being Prepared for Intrusion
process user tty cpu time time started
---------------------------------------------------------------------
sh root ?? 0.14 secs Mon Sep 25 00:45
killall root ?? 0.05 secs Mon Sep 25 00:45
cat root ?? 0.02 secs Mon Sep 25 00:45
cat root ?? 0.02 secs Mon Sep 25 00:45
rm root ?? 0.01 secs Mon Sep 25 00:45
strip root ?? 0.07 secs Mon Sep 25 00:45
gcc root ?? 0.05 secs Mon Sep 25 00:45
collect2 root ?? 0.03 secs Mon Sep 25 00:45
ld root ?? 0.23 secs Mon Sep 25 00:45
as root ?? 0.07 secs Mon Sep 25 00:45
cc1 root ?? 0.34 secs Mon Sep 25 00:45
cpp root ?? 0.05 secs Mon Sep 25 00:45
cp root ?? 0.01 secs Mon Sep 25 00:45
cat root ?? 0.02 secs Mon Sep 25 00:45
id root ?? 0.02 secs Mon Sep 25 00:45
ls root ?? 0.03 secs Mon Sep 25 00:45
Figure 2: Commands executed by the intruder. The commands are listed in reverse order of completion. The information shown is a reconstruction.
