9 Detecting intrusions
This chapter covers
- Examining the phases of an intrusion as it progresses through the infrastructure
- Detecting intrusions using indicators of compromise
- Using Linux audit logs to detect intrusions
- Inspecting the filesystems, memory, and network of endpoints remotely
- Filtering outbound network traffic using intrusion-detection systems
- Understanding the roles of developers and operators in detecting intrusions
July 2015. A hacker known by the pseudonym “Phineas Fisher” posts a short but terrifying message on Twitter:
gamma and HT down, a few more to go :)
The message quickly propagates across the information-security community. Gamma International and Hacking Team (HT) are two well-known security firms that sell offensive intrusion technologies. Both are known for selling exploits in popular software to the highest bidder, which gave them a bad reputation among security specialists. Phineas breached Gamma International in 2014, so the news of a breach of another high-profile security firm makes a lot of people nervous. Could Phineas possibly have broken into the network of one of the most paranoid security companies on the planet? People are suspicious at first, but Phineas quickly releases a dump of the company’s entire email server, removing any doubt that their defenses have been breached. But how?