Hacker News Reader

Comment by mjolk | Hacker News Reader

>In 2012, during an incident, we watched in real time as somebody logged into an account reserved for Huawei tech support, from the Huawei IP address space in mainland China.

I'm a little skeptical.

I wonder what they mean by "watched," because I doubt that they guessed the tty for reading or that the hacker joined a screen session. What is the likelihood that one would just "happen" to be staring at that server during an "incident."

View on HN

It was an internal system. We noticed with 'netstat' that it had a connection to an outside system. 'who' told us it was the account setup for Huawei remote support, and the IP address told us indeed that it was from a Huawei network.

The SQL query took 15 minutes to run. We saw it using 'ps'.

We then kept dumping their '.bash_history'.

That's weird. Bash_history doesn't usually get flushed for every command you run; only when you exit an interactive shell. If you `kill -9 $$` or erase the .bash_history file and create it as a directory, it loses the history. The exception is if you create a custom PROMPT_COMMAND="history -a; history -n", which would append on each new bash prompt. (You'd think a hacker would know these things...?)

As an alternative to dumping history, if your system has perl and strace and you want to watch a live ssh or bash session, I wrote a script that will do that. https://github.com/psypete/public-bin/blob/public-bin/src/sy...

That "history -a" bit is extremely common if the environment has shared storage like NFS in use or multiple shells are common. It would not surprise me at all to see it on by default on an account used for debugging / support purposes as a cheap audit measure.

It seems hard to believe someone doing something like this would not at least try to cover their tracks.

  export HISTSIZE=0?

And how do you know these were unmodified versions of netstat, who and ps that you ran?

Do they have mtree in this OS?

I'm no security expert but this little story just sounds very unsophisticated given the seriousness you are attributing to it.

Google "live incident response" software. The author works for a security company, they get hired to detect malware and intruders.

You can remotely connect to machines and analyze memory, commands, etc. It doesn't matter what TTY it was when you have full system access.

http://digital-forensics.sans.org/blog/2011/07/21/live-mem-f...

https://code.google.com/p/grr/

https://www.mandiant.com/resources/download/redline

I wonder what they mean by "watched"...

My interpretation was that after IDS had identified a particular host, they had tailed syslog (or the equivalent) on that host. The observation that they would have missed it if they hadn't been watching seems to imply that normally their logs wouldn't have retained the level of detail needed to see either the event or the deletion of the logs of the event.

From encrypting and emailing to a hotmail account, it sounds like they connected with Teamviewer/VNC type of software and author was watching what was going on the screen.

I am somewhat skeptical as well.

Unless the support staff use screen sharing software for doing support, and what was witnessed was an unannounced support session?

Reply on news.ycombinator.com