Re: one of my servers has been compromized

[John Jacobs <flamdugen () hotmail com>]

> Why take the risk? You don't know what the attacker actually did
> until you do some analysis. If you do analysis before capturing a
> disk image, you're destroying evidence.
>
> Rebuilding a server is not hard. It has a known quantity of effort
> involved and reliably prevents further intrusion which leverages the
> access previously gained.
>
> On the other hand, conducting an investigation to the point where you
> are reasonably sure an attacker can't continue to leverage that access
> costs a lot of time and money.

I'm conflicted here, though I do agree with what you say.  A simple attack lacking any sophistication whose goal is 
simply to drop an IRC bot and nothing more may result in undue expense through effort and analysis.  Conversely, 
assuming that former does not confirm the scope of attack or impact...  I'm conflicted but I agree with your assessment.

Perhaps in this situation one would be more likely to fall back on the output of the defense in depth tools previously 
recommended.  In this case they are not available so perhaps caution is wise as you have suggested.

I think it reasonable to assume a documented and vulnerable out of date world-accessible version of PHPMyAdmin is 
likely the initial attack vector.  The Apache/PHP logs should prove this to be the case, so rebuilding a box and 
disabling PHPMyAdmin may be a reasonable response to this incident without the need for forensic analysis... depending 
on the organization.  If this box is a singular VPS I think it reasonable, if it's a part of a larger system which 
could be leveraged as a launching platform to attack other LAN or organizational-owned boxes then by all means a 
comprehensive analysis should be undertaken.

Tim thanks for your thoughts and reply.

Thanks,
John
                                          
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/