When a server gets rooted, should I disconnect network or power?

Posted by Aleksandr Levchuk on Server Fault See other posts from Server Fault or by Aleksandr Levchuk
Published on 2011-01-03T20:36:55Z Indexed on 2011/01/03 20:55 UTC
Read the original article Hit count: 301

Filed under:

security

|

rootkit

|

system-compromise

When a server gets rooted (e.g. a situation like this), one of the first things that should be done is containment. Quoting from Robert Moir's Answer:

"disconnect the victim from its muggers"

A server can be contained by pulling the network cable or the power cable.

Taking into consideration the need for:

Protecting victims from further damage
Executing successful forensics
(Possibly) Protecting valuable data on the server

Which method is better?

© Server Fault or respective owner

Related posts about security

sudo apt-get update errors

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
Here is what I get on my terminal when running sudo apt-get update errors. I dont know if the issue is from my sources.list or my proxy setup(have not made any changes to proxies). Thank you for any help in advanced. Ign http://security.ubuntu.com oneiric-security Release.gpg Ign http://security… >>> More
The Security-Developer Gap: Why IT Security Can't Fix Your Security Problems Alone

as seen on Devx - Search for 'Devx'
Two well-known white hats explain how hackers take advantage of security holes left by enterprise application developers. >>> More
The Security-Developer Gap: Why IT Security Can't Fix Your Security Problems Alone

as seen on Internet.com - Search for 'Internet.com'
Two well-known white hats explain how hackers take advantage of security holes left by enterprise application developers. >>> More
StackOverFlowError while creating Mac object on AS400/Java

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello all, I am a newbie to AS400-Java programming. I am trying to create my first program to test the implementation of Message Authentication Code (MAC). I am trying to use the HMACSHA1 hash function. My (Java 1.4) program runs fine on a dev box (V5R4).But fails terribly on the QA box (V5R3). My… >>> More
Google App Engine - Spring Security Issue (java.security.AccessControlException)

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm currently getting the AccessControlException below when I deploy to app engine (I don't see it when I run in my local environment). I'm using GAE 1.3.1, Spring 3.0.1, and Spring Security 3.0.2. Any ideas how to get around this issue? It appears to be an issue with Spring Security trying to get… >>> More

Related posts about rootkit

Rkhunter 122 suspect files; do I have a problem?

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I am new to ubuntu. I am using Xfce Ubuntu 14.04 LTS. I have ran rkhunter a few weeks age and only got a few warnings. The forum said that they were normal. But, this time rkhunter reported 122 warnings. Please advise. casey@Shaman:~$ sudo rkhunter -c [ Rootkit Hunter version 1.4.0 ] Checking… >>> More
Microsoft Says Rootkit Causes XP 'Blue Screens'

as seen on Internet.com - Search for 'Internet.com'
After a week-long investigation, Microsoft bug sleuths claim they've hunted down the cause of multiple reboots and crashes inflicted on Windows XP users. >>> More
Latest Microsoft Patch Aims To Block Rootkit

as seen on Internet.com - Search for 'Internet.com'
Patch meant to kill off 17-year-old bug was suspected of causing multiple crashes and continuous reboots, but the problems were traced to a rootkit. But since the patch won't install on infected systems, what will users do now? >>> More
Latest Microsoft Patch Aims To Block Rootkit

as seen on Internet.com - Search for 'Internet.com'
Patch meant to kill off 17-year-old bug was suspected of causing multiple crashes and continuous reboots, but the problems were traced to a rootkit. But since the patch won't install on infected systems, what will users do now? >>> More
Microsoft Redux: Windows XP Patch Back to Block Rootkit

as seen on Internet.com - Search for 'Internet.com'
The software giant re-releases the bug patch that some Windows XP users blamed for repeated restarts and blue screen crashes following February's Patch Tuesday release. >>> More